icmp6.c revision 121315
1/*	$FreeBSD: head/sys/netinet6/icmp6.c 121315 2003-10-21 20:05:32Z ume $	*/
2/*	$KAME: icmp6.c,v 1.211 2001/04/04 05:56:20 itojun Exp $	*/
3
4/*
5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 *    notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the project nor the names of its contributors
17 *    may be used to endorse or promote products derived from this software
18 *    without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33/*
34 * Copyright (c) 1982, 1986, 1988, 1993
35 *	The Regents of the University of California.  All rights reserved.
36 *
37 * Redistribution and use in source and binary forms, with or without
38 * modification, are permitted provided that the following conditions
39 * are met:
40 * 1. Redistributions of source code must retain the above copyright
41 *    notice, this list of conditions and the following disclaimer.
42 * 2. Redistributions in binary form must reproduce the above copyright
43 *    notice, this list of conditions and the following disclaimer in the
44 *    documentation and/or other materials provided with the distribution.
45 * 3. All advertising materials mentioning features or use of this software
46 *    must display the following acknowledgement:
47 *	This product includes software developed by the University of
48 *	California, Berkeley and its contributors.
49 * 4. Neither the name of the University nor the names of its contributors
50 *    may be used to endorse or promote products derived from this software
51 *    without specific prior written permission.
52 *
53 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
54 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
55 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
56 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
57 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
58 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
59 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
60 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
61 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
62 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
63 * SUCH DAMAGE.
64 *
65 *	@(#)ip_icmp.c	8.2 (Berkeley) 1/4/94
66 */
67
68#include "opt_inet.h"
69#include "opt_inet6.h"
70#include "opt_ipsec.h"
71
72#include <sys/param.h>
73#include <sys/domain.h>
74#include <sys/kernel.h>
75#include <sys/lock.h>
76#include <sys/malloc.h>
77#include <sys/mbuf.h>
78#include <sys/protosw.h>
79#include <sys/signalvar.h>
80#include <sys/socket.h>
81#include <sys/socketvar.h>
82#include <sys/sx.h>
83#include <sys/syslog.h>
84#include <sys/systm.h>
85#include <sys/time.h>
86
87#include <net/if.h>
88#include <net/if_dl.h>
89#include <net/if_types.h>
90#include <net/route.h>
91
92#include <netinet/in.h>
93#include <netinet/in_pcb.h>
94#include <netinet/in_var.h>
95#include <netinet/ip6.h>
96#include <netinet/icmp6.h>
97#include <netinet6/in6_ifattach.h>
98#include <netinet6/in6_pcb.h>
99#include <netinet6/ip6protosw.h>
100#include <netinet6/ip6_var.h>
101#include <netinet6/mld6_var.h>
102#include <netinet6/nd6.h>
103
104#ifdef IPSEC
105#include <netinet6/ipsec.h>
106#include <netkey/key.h>
107#endif
108
109#ifdef FAST_IPSEC
110#include <netipsec/ipsec.h>
111#include <netipsec/key.h>
112#define	IPSEC
113#endif
114
115#include <net/net_osdep.h>
116
117#ifdef HAVE_NRL_INPCB
118/* inpcb members */
119#define in6pcb		inpcb
120#define in6p_laddr	inp_laddr6
121#define in6p_faddr	inp_faddr6
122#define in6p_icmp6filt	inp_icmp6filt
123#define in6p_route	inp_route
124#define in6p_socket	inp_socket
125#define in6p_flags	inp_flags
126#define in6p_moptions	inp_moptions6
127#define in6p_outputopts	inp_outputopts6
128#define in6p_ip6	inp_ipv6
129#define in6p_flowinfo	inp_flowinfo
130#define in6p_sp		inp_sp
131#define in6p_next	inp_next
132#define in6p_prev	inp_prev
133/* macro names */
134#define sotoin6pcb	sotoinpcb
135/* function names */
136#define in6_pcbdetach	in_pcbdetach
137#define in6_rtchange	in_rtchange
138
139/*
140 * for KAME src sync over BSD*'s. XXX: FreeBSD (>=3) are VERY different from
141 * others...
142 */
143#define in6p_ip6_nxt	inp_ipv6.ip6_nxt
144#endif
145
146extern struct domain inet6domain;
147
148struct icmp6stat icmp6stat;
149
150extern struct inpcbhead ripcb;
151extern int icmp6errppslim;
152static int icmp6errpps_count = 0;
153static struct timeval icmp6errppslim_last;
154extern int icmp6_nodeinfo;
155
156static void icmp6_errcount __P((struct icmp6errstat *, int, int));
157static int icmp6_rip6_input __P((struct mbuf **, int));
158static int icmp6_ratelimit __P((const struct in6_addr *, const int, const int));
159static const char *icmp6_redirect_diag __P((struct in6_addr *,
160	struct in6_addr *, struct in6_addr *));
161#define	HAVE_PPSRATECHECK
162#ifndef HAVE_PPSRATECHECK
163static int ppsratecheck __P((struct timeval *, int *, int));
164#endif
165static struct mbuf *ni6_input __P((struct mbuf *, int));
166static struct mbuf *ni6_nametodns __P((const char *, int, int));
167static int ni6_dnsmatch __P((const char *, int, const char *, int));
168static int ni6_addrs __P((struct icmp6_nodeinfo *, struct mbuf *,
169			  struct ifnet **, char *));
170static int ni6_store_addrs __P((struct icmp6_nodeinfo *, struct icmp6_nodeinfo *,
171				struct ifnet *, int));
172static int icmp6_notify_error __P((struct mbuf *, int, int, int));
173
174#ifdef COMPAT_RFC1885
175static struct route_in6 icmp6_reflect_rt;
176#endif
177
178
179void
180icmp6_init()
181{
182	mld6_init();
183}
184
185static void
186icmp6_errcount(stat, type, code)
187	struct icmp6errstat *stat;
188	int type, code;
189{
190	switch (type) {
191	case ICMP6_DST_UNREACH:
192		switch (code) {
193		case ICMP6_DST_UNREACH_NOROUTE:
194			stat->icp6errs_dst_unreach_noroute++;
195			return;
196		case ICMP6_DST_UNREACH_ADMIN:
197			stat->icp6errs_dst_unreach_admin++;
198			return;
199		case ICMP6_DST_UNREACH_BEYONDSCOPE:
200			stat->icp6errs_dst_unreach_beyondscope++;
201			return;
202		case ICMP6_DST_UNREACH_ADDR:
203			stat->icp6errs_dst_unreach_addr++;
204			return;
205		case ICMP6_DST_UNREACH_NOPORT:
206			stat->icp6errs_dst_unreach_noport++;
207			return;
208		}
209		break;
210	case ICMP6_PACKET_TOO_BIG:
211		stat->icp6errs_packet_too_big++;
212		return;
213	case ICMP6_TIME_EXCEEDED:
214		switch (code) {
215		case ICMP6_TIME_EXCEED_TRANSIT:
216			stat->icp6errs_time_exceed_transit++;
217			return;
218		case ICMP6_TIME_EXCEED_REASSEMBLY:
219			stat->icp6errs_time_exceed_reassembly++;
220			return;
221		}
222		break;
223	case ICMP6_PARAM_PROB:
224		switch (code) {
225		case ICMP6_PARAMPROB_HEADER:
226			stat->icp6errs_paramprob_header++;
227			return;
228		case ICMP6_PARAMPROB_NEXTHEADER:
229			stat->icp6errs_paramprob_nextheader++;
230			return;
231		case ICMP6_PARAMPROB_OPTION:
232			stat->icp6errs_paramprob_option++;
233			return;
234		}
235		break;
236	case ND_REDIRECT:
237		stat->icp6errs_redirect++;
238		return;
239	}
240	stat->icp6errs_unknown++;
241}
242
243/*
244 * Generate an error packet of type error in response to bad IP6 packet.
245 */
246void
247icmp6_error(m, type, code, param)
248	struct mbuf *m;
249	int type, code, param;
250{
251	struct ip6_hdr *oip6, *nip6;
252	struct icmp6_hdr *icmp6;
253	u_int preplen;
254	int off;
255	int nxt;
256
257	icmp6stat.icp6s_error++;
258
259	/* count per-type-code statistics */
260	icmp6_errcount(&icmp6stat.icp6s_outerrhist, type, code);
261
262#ifdef M_DECRYPTED	/*not openbsd*/
263	if (m->m_flags & M_DECRYPTED) {
264		icmp6stat.icp6s_canterror++;
265		goto freeit;
266	}
267#endif
268
269#ifndef PULLDOWN_TEST
270	IP6_EXTHDR_CHECK(m, 0, sizeof(struct ip6_hdr), );
271#else
272	if (m->m_len < sizeof(struct ip6_hdr)) {
273		m = m_pullup(m, sizeof(struct ip6_hdr));
274		if (m == NULL)
275			return;
276	}
277#endif
278	oip6 = mtod(m, struct ip6_hdr *);
279
280	/*
281	 * Multicast destination check. For unrecognized option errors,
282	 * this check has already done in ip6_unknown_opt(), so we can
283	 * check only for other errors.
284	 */
285	if ((m->m_flags & (M_BCAST|M_MCAST) ||
286	     IN6_IS_ADDR_MULTICAST(&oip6->ip6_dst)) &&
287	    (type != ICMP6_PACKET_TOO_BIG &&
288	     (type != ICMP6_PARAM_PROB ||
289	      code != ICMP6_PARAMPROB_OPTION)))
290		goto freeit;
291
292	/* Source address check. XXX: the case of anycast source? */
293	if (IN6_IS_ADDR_UNSPECIFIED(&oip6->ip6_src) ||
294	    IN6_IS_ADDR_MULTICAST(&oip6->ip6_src))
295		goto freeit;
296
297	/*
298	 * If we are about to send ICMPv6 against ICMPv6 error/redirect,
299	 * don't do it.
300	 */
301	nxt = -1;
302	off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt);
303	if (off >= 0 && nxt == IPPROTO_ICMPV6) {
304		struct icmp6_hdr *icp;
305
306#ifndef PULLDOWN_TEST
307		IP6_EXTHDR_CHECK(m, 0, off + sizeof(struct icmp6_hdr), );
308		icp = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
309#else
310		IP6_EXTHDR_GET(icp, struct icmp6_hdr *, m, off,
311			sizeof(*icp));
312		if (icp == NULL) {
313			icmp6stat.icp6s_tooshort++;
314			return;
315		}
316#endif
317		if (icp->icmp6_type < ICMP6_ECHO_REQUEST ||
318		    icp->icmp6_type == ND_REDIRECT) {
319			/*
320			 * ICMPv6 error
321			 * Special case: for redirect (which is
322			 * informational) we must not send icmp6 error.
323			 */
324			icmp6stat.icp6s_canterror++;
325			goto freeit;
326		} else {
327			/* ICMPv6 informational - send the error */
328		}
329	} else {
330		/* non-ICMPv6 - send the error */
331	}
332
333	oip6 = mtod(m, struct ip6_hdr *); /* adjust pointer */
334
335	/* Finally, do rate limitation check. */
336	if (icmp6_ratelimit(&oip6->ip6_src, type, code)) {
337		icmp6stat.icp6s_toofreq++;
338		goto freeit;
339	}
340
341	/*
342	 * OK, ICMP6 can be generated.
343	 */
344
345	if (m->m_pkthdr.len >= ICMPV6_PLD_MAXLEN)
346		m_adj(m, ICMPV6_PLD_MAXLEN - m->m_pkthdr.len);
347
348	preplen = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
349	M_PREPEND(m, preplen, M_DONTWAIT);
350	if (m && m->m_len < preplen)
351		m = m_pullup(m, preplen);
352	if (m == NULL) {
353		nd6log((LOG_DEBUG, "ENOBUFS in icmp6_error %d\n", __LINE__));
354		return;
355	}
356
357	nip6 = mtod(m, struct ip6_hdr *);
358	nip6->ip6_src  = oip6->ip6_src;
359	nip6->ip6_dst  = oip6->ip6_dst;
360
361	in6_clearscope(&oip6->ip6_src);
362	in6_clearscope(&oip6->ip6_dst);
363
364	icmp6 = (struct icmp6_hdr *)(nip6 + 1);
365	icmp6->icmp6_type = type;
366	icmp6->icmp6_code = code;
367	icmp6->icmp6_pptr = htonl((u_int32_t)param);
368
369	/*
370	 * icmp6_reflect() is designed to be in the input path.
371	 * icmp6_error() can be called from both input and outut path,
372	 * and if we are in output path rcvif could contain bogus value.
373	 * clear m->m_pkthdr.rcvif for safety, we should have enough scope
374	 * information in ip header (nip6).
375	 */
376	m->m_pkthdr.rcvif = NULL;
377
378	icmp6stat.icp6s_outhist[type]++;
379	icmp6_reflect(m, sizeof(struct ip6_hdr)); /* header order: IPv6 - ICMPv6 */
380
381	return;
382
383  freeit:
384	/*
385	 * If we can't tell wheter or not we can generate ICMP6, free it.
386	 */
387	m_freem(m);
388}
389
390/*
391 * Process a received ICMP6 message.
392 */
393int
394icmp6_input(mp, offp, proto)
395	struct mbuf **mp;
396	int *offp, proto;
397{
398	struct mbuf *m = *mp, *n;
399	struct ip6_hdr *ip6, *nip6;
400	struct icmp6_hdr *icmp6, *nicmp6;
401	int off = *offp;
402	int icmp6len = m->m_pkthdr.len - *offp;
403	int code, sum, noff;
404
405#ifndef PULLDOWN_TEST
406	IP6_EXTHDR_CHECK(m, off, sizeof(struct icmp6_hdr), IPPROTO_DONE);
407	/* m might change if M_LOOP.  So, call mtod after this */
408#endif
409
410	/*
411	 * Locate icmp6 structure in mbuf, and check
412	 * that not corrupted and of at least minimum length
413	 */
414
415	ip6 = mtod(m, struct ip6_hdr *);
416	if (icmp6len < sizeof(struct icmp6_hdr)) {
417		icmp6stat.icp6s_tooshort++;
418		goto freeit;
419	}
420
421	/*
422	 * calculate the checksum
423	 */
424#ifndef PULLDOWN_TEST
425	icmp6 = (struct icmp6_hdr *)((caddr_t)ip6 + off);
426#else
427	IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off, sizeof(*icmp6));
428	if (icmp6 == NULL) {
429		icmp6stat.icp6s_tooshort++;
430		return IPPROTO_DONE;
431	}
432#endif
433	code = icmp6->icmp6_code;
434
435	if ((sum = in6_cksum(m, IPPROTO_ICMPV6, off, icmp6len)) != 0) {
436		nd6log((LOG_ERR,
437		    "ICMP6 checksum error(%d|%x) %s\n",
438		    icmp6->icmp6_type, sum, ip6_sprintf(&ip6->ip6_src)));
439		icmp6stat.icp6s_checksum++;
440		goto freeit;
441	}
442
443	if (faithprefix_p != NULL && (*faithprefix_p)(&ip6->ip6_dst)) {
444		/*
445		 * Deliver very specific ICMP6 type only.
446		 * This is important to deilver TOOBIG.  Otherwise PMTUD
447		 * will not work.
448		 */
449		switch (icmp6->icmp6_type) {
450		case ICMP6_DST_UNREACH:
451		case ICMP6_PACKET_TOO_BIG:
452		case ICMP6_TIME_EXCEEDED:
453			break;
454		default:
455			goto freeit;
456		}
457	}
458
459	icmp6stat.icp6s_inhist[icmp6->icmp6_type]++;
460	icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_msg);
461	if (icmp6->icmp6_type < ICMP6_INFOMSG_MASK)
462		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_error);
463
464	switch (icmp6->icmp6_type) {
465	case ICMP6_DST_UNREACH:
466		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_dstunreach);
467		switch (code) {
468		case ICMP6_DST_UNREACH_NOROUTE:
469			code = PRC_UNREACH_NET;
470			break;
471		case ICMP6_DST_UNREACH_ADMIN:
472			icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_adminprohib);
473			code = PRC_UNREACH_PROTOCOL; /* is this a good code? */
474			break;
475		case ICMP6_DST_UNREACH_ADDR:
476			code = PRC_HOSTDEAD;
477			break;
478#ifdef COMPAT_RFC1885
479		case ICMP6_DST_UNREACH_NOTNEIGHBOR:
480			code = PRC_UNREACH_SRCFAIL;
481			break;
482#else
483		case ICMP6_DST_UNREACH_BEYONDSCOPE:
484			/* I mean "source address was incorrect." */
485			code = PRC_PARAMPROB;
486			break;
487#endif
488		case ICMP6_DST_UNREACH_NOPORT:
489			code = PRC_UNREACH_PORT;
490			break;
491		default:
492			goto badcode;
493		}
494		goto deliver;
495		break;
496
497	case ICMP6_PACKET_TOO_BIG:
498		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_pkttoobig);
499		if (code != 0)
500			goto badcode;
501
502		code = PRC_MSGSIZE;
503
504		/*
505		 * Updating the path MTU will be done after examining
506		 * intermediate extension headers.
507		 */
508		goto deliver;
509		break;
510
511	case ICMP6_TIME_EXCEEDED:
512		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_timeexceed);
513		switch (code) {
514		case ICMP6_TIME_EXCEED_TRANSIT:
515		case ICMP6_TIME_EXCEED_REASSEMBLY:
516			code += PRC_TIMXCEED_INTRANS;
517			break;
518		default:
519			goto badcode;
520		}
521		goto deliver;
522		break;
523
524	case ICMP6_PARAM_PROB:
525		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_paramprob);
526		switch (code) {
527		case ICMP6_PARAMPROB_NEXTHEADER:
528			code = PRC_UNREACH_PROTOCOL;
529			break;
530		case ICMP6_PARAMPROB_HEADER:
531		case ICMP6_PARAMPROB_OPTION:
532			code = PRC_PARAMPROB;
533			break;
534		default:
535			goto badcode;
536		}
537		goto deliver;
538		break;
539
540	case ICMP6_ECHO_REQUEST:
541		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_echo);
542		if (code != 0)
543			goto badcode;
544		if ((n = m_copy(m, 0, M_COPYALL)) == NULL) {
545			/* Give up remote */
546			break;
547		}
548		if ((n->m_flags & M_EXT) != 0
549		 || n->m_len < off + sizeof(struct icmp6_hdr)) {
550			struct mbuf *n0 = n;
551			const int maxlen = sizeof(*nip6) + sizeof(*nicmp6);
552			int n0len;
553
554			/*
555			 * Prepare an internal mbuf.  m_pullup() doesn't
556			 * always copy the length we specified.
557			 */
558			if (maxlen >= MCLBYTES) {
559				/* Give up remote */
560				m_freem(n0);
561				break;
562			}
563			MGETHDR(n, M_DONTWAIT, n0->m_type);
564			n0len = n0->m_pkthdr.len;	/* save for use below */
565			if (n)
566				M_MOVE_PKTHDR(n, n0);
567			if (n && maxlen >= MHLEN) {
568				MCLGET(n, M_DONTWAIT);
569				if ((n->m_flags & M_EXT) == 0) {
570					m_free(n);
571					n = NULL;
572				}
573			}
574			if (n == NULL) {
575				/* Give up remote */
576				m_freem(n0);
577				break;
578			}
579			/*
580			 * Copy IPv6 and ICMPv6 only.
581			 */
582			nip6 = mtod(n, struct ip6_hdr *);
583			bcopy(ip6, nip6, sizeof(struct ip6_hdr));
584			nicmp6 = (struct icmp6_hdr *)(nip6 + 1);
585			bcopy(icmp6, nicmp6, sizeof(struct icmp6_hdr));
586			noff = sizeof(struct ip6_hdr);
587			/* new mbuf contains only ipv6+icmpv6 headers */
588			n->m_len = noff + sizeof(struct icmp6_hdr);
589			/*
590			 * Adjust mbuf.  ip6_plen will be adjusted in
591			 * ip6_output().
592			 */
593			m_adj(n0, off + sizeof(struct icmp6_hdr));
594			/* recalculate complete packet size */
595			n->m_pkthdr.len = n0len + (noff - off);
596			n->m_next = n0;
597		} else {
598			nip6 = mtod(n, struct ip6_hdr *);
599			nicmp6 = (struct icmp6_hdr *)((caddr_t)nip6 + off);
600			noff = off;
601		}
602		nicmp6->icmp6_type = ICMP6_ECHO_REPLY;
603		nicmp6->icmp6_code = 0;
604		if (n) {
605			icmp6stat.icp6s_reflect++;
606			icmp6stat.icp6s_outhist[ICMP6_ECHO_REPLY]++;
607			icmp6_reflect(n, noff);
608		}
609		break;
610
611	case ICMP6_ECHO_REPLY:
612		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_echoreply);
613		if (code != 0)
614			goto badcode;
615		break;
616
617	case MLD_LISTENER_QUERY:
618	case MLD_LISTENER_REPORT:
619		if (icmp6len < sizeof(struct mld_hdr))
620			goto badlen;
621		if (icmp6->icmp6_type == MLD_LISTENER_QUERY) /* XXX: ugly... */
622			icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mldquery);
623		else
624			icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mldreport);
625		if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
626			/* give up local */
627			mld6_input(m, off);
628			m = NULL;
629			goto freeit;
630		}
631		mld6_input(n, off);
632		/* m stays. */
633		break;
634
635	case MLD_LISTENER_DONE:
636		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mlddone);
637		if (icmp6len < sizeof(struct mld_hdr))	/* necessary? */
638			goto badlen;
639		break;		/* nothing to be done in kernel */
640
641	case MLD_MTRACE_RESP:
642	case MLD_MTRACE:
643		/* XXX: these two are experimental.  not officially defined. */
644		/* XXX: per-interface statistics? */
645		break;		/* just pass it to applications */
646
647	case ICMP6_WRUREQUEST:	/* ICMP6_FQDN_QUERY */
648	    {
649		enum { WRU, FQDN } mode;
650
651		if (!icmp6_nodeinfo)
652			break;
653
654		if (icmp6len == sizeof(struct icmp6_hdr) + 4)
655			mode = WRU;
656		else if (icmp6len >= sizeof(struct icmp6_nodeinfo))
657			mode = FQDN;
658		else
659			goto badlen;
660
661#define hostnamelen	strlen(hostname)
662		if (mode == FQDN) {
663#ifndef PULLDOWN_TEST
664			IP6_EXTHDR_CHECK(m, off, sizeof(struct icmp6_nodeinfo),
665			    IPPROTO_DONE);
666#endif
667			n = m_copy(m, 0, M_COPYALL);
668			if (n)
669				n = ni6_input(n, off);
670			/* XXX meaningless if n == NULL */
671			noff = sizeof(struct ip6_hdr);
672		} else {
673			u_char *p;
674			int maxlen, maxhlen;
675
676			if ((icmp6_nodeinfo & 5) != 5)
677				break;
678
679			if (code != 0)
680				goto badcode;
681			maxlen = sizeof(*nip6) + sizeof(*nicmp6) + 4;
682			if (maxlen >= MCLBYTES) {
683				/* Give up remote */
684				break;
685			}
686			MGETHDR(n, M_DONTWAIT, m->m_type);
687			if (n && maxlen > MHLEN) {
688				MCLGET(n, M_DONTWAIT);
689				if ((n->m_flags & M_EXT) == 0) {
690					m_free(n);
691					n = NULL;
692				}
693			}
694			if (!m_dup_pkthdr(n, m, M_DONTWAIT)) {
695				/*
696				 * Previous code did a blind M_COPY_PKTHDR
697				 * and said "just for rcvif".  If true, then
698				 * we could tolerate the dup failing (due to
699				 * the deep copy of the tag chain).  For now
700				 * be conservative and just fail.
701				 */
702				m_free(n);
703				n = NULL;
704			}
705			if (n == NULL) {
706				/* Give up remote */
707				break;
708			}
709			n->m_pkthdr.rcvif = NULL;
710			n->m_len = 0;
711			maxhlen = M_TRAILINGSPACE(n) - maxlen;
712			if (maxhlen > hostnamelen)
713				maxhlen = hostnamelen;
714			/*
715			 * Copy IPv6 and ICMPv6 only.
716			 */
717			nip6 = mtod(n, struct ip6_hdr *);
718			bcopy(ip6, nip6, sizeof(struct ip6_hdr));
719			nicmp6 = (struct icmp6_hdr *)(nip6 + 1);
720			bcopy(icmp6, nicmp6, sizeof(struct icmp6_hdr));
721			p = (u_char *)(nicmp6 + 1);
722			bzero(p, 4);
723			bcopy(hostname, p + 4, maxhlen); /* meaningless TTL */
724			noff = sizeof(struct ip6_hdr);
725			n->m_pkthdr.len = n->m_len = sizeof(struct ip6_hdr) +
726				sizeof(struct icmp6_hdr) + 4 + maxhlen;
727			nicmp6->icmp6_type = ICMP6_WRUREPLY;
728			nicmp6->icmp6_code = 0;
729		}
730#undef hostnamelen
731		if (n) {
732			icmp6stat.icp6s_reflect++;
733			icmp6stat.icp6s_outhist[ICMP6_WRUREPLY]++;
734			icmp6_reflect(n, noff);
735		}
736		break;
737	    }
738
739	case ICMP6_WRUREPLY:
740		if (code != 0)
741			goto badcode;
742		break;
743
744	case ND_ROUTER_SOLICIT:
745		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_routersolicit);
746		if (code != 0)
747			goto badcode;
748		if (icmp6len < sizeof(struct nd_router_solicit))
749			goto badlen;
750		if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
751			/* give up local */
752			nd6_rs_input(m, off, icmp6len);
753			m = NULL;
754			goto freeit;
755		}
756		nd6_rs_input(n, off, icmp6len);
757		/* m stays. */
758		break;
759
760	case ND_ROUTER_ADVERT:
761		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_routeradvert);
762		if (code != 0)
763			goto badcode;
764		if (icmp6len < sizeof(struct nd_router_advert))
765			goto badlen;
766		if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
767			/* give up local */
768			nd6_ra_input(m, off, icmp6len);
769			m = NULL;
770			goto freeit;
771		}
772		nd6_ra_input(n, off, icmp6len);
773		/* m stays. */
774		break;
775
776	case ND_NEIGHBOR_SOLICIT:
777		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_neighborsolicit);
778		if (code != 0)
779			goto badcode;
780		if (icmp6len < sizeof(struct nd_neighbor_solicit))
781			goto badlen;
782		if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
783			/* give up local */
784			nd6_ns_input(m, off, icmp6len);
785			m = NULL;
786			goto freeit;
787		}
788		nd6_ns_input(n, off, icmp6len);
789		/* m stays. */
790		break;
791
792	case ND_NEIGHBOR_ADVERT:
793		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_neighboradvert);
794		if (code != 0)
795			goto badcode;
796		if (icmp6len < sizeof(struct nd_neighbor_advert))
797			goto badlen;
798		if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
799			/* give up local */
800			nd6_na_input(m, off, icmp6len);
801			m = NULL;
802			goto freeit;
803		}
804		nd6_na_input(n, off, icmp6len);
805		/* m stays. */
806		break;
807
808	case ND_REDIRECT:
809		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_redirect);
810		if (code != 0)
811			goto badcode;
812		if (icmp6len < sizeof(struct nd_redirect))
813			goto badlen;
814		if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
815			/* give up local */
816			icmp6_redirect_input(m, off);
817			m = NULL;
818			goto freeit;
819		}
820		icmp6_redirect_input(n, off);
821		/* m stays. */
822		break;
823
824	case ICMP6_ROUTER_RENUMBERING:
825		if (code != ICMP6_ROUTER_RENUMBERING_COMMAND &&
826		    code != ICMP6_ROUTER_RENUMBERING_RESULT)
827			goto badcode;
828		if (icmp6len < sizeof(struct icmp6_router_renum))
829			goto badlen;
830		break;
831
832	default:
833		nd6log((LOG_DEBUG,
834		    "icmp6_input: unknown type %d(src=%s, dst=%s, ifid=%d)\n",
835		    icmp6->icmp6_type, ip6_sprintf(&ip6->ip6_src),
836		    ip6_sprintf(&ip6->ip6_dst),
837		    m->m_pkthdr.rcvif ? m->m_pkthdr.rcvif->if_index : 0));
838		if (icmp6->icmp6_type < ICMP6_ECHO_REQUEST) {
839			/* ICMPv6 error: MUST deliver it by spec... */
840			code = PRC_NCMDS;
841			/* deliver */
842		} else {
843			/* ICMPv6 informational: MUST not deliver */
844			break;
845		}
846	deliver:
847		if (icmp6_notify_error(m, off, icmp6len, code)) {
848			/* In this case, m should've been freed. */
849			return (IPPROTO_DONE);
850		}
851		break;
852
853	badcode:
854		icmp6stat.icp6s_badcode++;
855		break;
856
857	badlen:
858		icmp6stat.icp6s_badlen++;
859		break;
860	}
861
862	/* deliver the packet to appropriate sockets */
863	icmp6_rip6_input(&m, *offp);
864
865	return IPPROTO_DONE;
866
867 freeit:
868	m_freem(m);
869	return IPPROTO_DONE;
870}
871
872static int
873icmp6_notify_error(m, off, icmp6len, code)
874	struct mbuf *m;
875	int off, icmp6len, code;
876{
877	struct icmp6_hdr *icmp6;
878	struct ip6_hdr *eip6;
879	u_int32_t notifymtu;
880	struct sockaddr_in6 icmp6src, icmp6dst;
881
882	if (icmp6len < sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr)) {
883		icmp6stat.icp6s_tooshort++;
884		goto freeit;
885	}
886#ifndef PULLDOWN_TEST
887	IP6_EXTHDR_CHECK(m, off,
888	    sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr), -1);
889	icmp6 = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
890#else
891	IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off,
892	    sizeof(*icmp6) + sizeof(struct ip6_hdr));
893	if (icmp6 == NULL) {
894		icmp6stat.icp6s_tooshort++;
895		return (-1);
896	}
897#endif
898	eip6 = (struct ip6_hdr *)(icmp6 + 1);
899
900	/* Detect the upper level protocol */
901	{
902		void (*ctlfunc) __P((int, struct sockaddr *, void *));
903		u_int8_t nxt = eip6->ip6_nxt;
904		int eoff = off + sizeof(struct icmp6_hdr) +
905		    sizeof(struct ip6_hdr);
906		struct ip6ctlparam ip6cp;
907		struct in6_addr *finaldst = NULL;
908		int icmp6type = icmp6->icmp6_type;
909		struct ip6_frag *fh;
910		struct ip6_rthdr *rth;
911		struct ip6_rthdr0 *rth0;
912		int rthlen;
913
914		while (1) { /* XXX: should avoid infinite loop explicitly? */
915			struct ip6_ext *eh;
916
917			switch (nxt) {
918			case IPPROTO_HOPOPTS:
919			case IPPROTO_DSTOPTS:
920			case IPPROTO_AH:
921#ifndef PULLDOWN_TEST
922				IP6_EXTHDR_CHECK(m, 0,
923				    eoff + sizeof(struct ip6_ext), -1);
924				eh = (struct ip6_ext *)(mtod(m, caddr_t) + eoff);
925#else
926				IP6_EXTHDR_GET(eh, struct ip6_ext *, m,
927				    eoff, sizeof(*eh));
928				if (eh == NULL) {
929					icmp6stat.icp6s_tooshort++;
930					return (-1);
931				}
932#endif
933
934				if (nxt == IPPROTO_AH)
935					eoff += (eh->ip6e_len + 2) << 2;
936				else
937					eoff += (eh->ip6e_len + 1) << 3;
938				nxt = eh->ip6e_nxt;
939				break;
940			case IPPROTO_ROUTING:
941				/*
942				 * When the erroneous packet contains a
943				 * routing header, we should examine the
944				 * header to determine the final destination.
945				 * Otherwise, we can't properly update
946				 * information that depends on the final
947				 * destination (e.g. path MTU).
948				 */
949#ifndef PULLDOWN_TEST
950				IP6_EXTHDR_CHECK(m, 0, eoff + sizeof(*rth), -1);
951				rth = (struct ip6_rthdr *)
952				    (mtod(m, caddr_t) + eoff);
953#else
954				IP6_EXTHDR_GET(rth, struct ip6_rthdr *, m,
955				    eoff, sizeof(*rth));
956				if (rth == NULL) {
957					icmp6stat.icp6s_tooshort++;
958					return (-1);
959				}
960#endif
961				rthlen = (rth->ip6r_len + 1) << 3;
962				/*
963				 * XXX: currently there is no
964				 * officially defined type other
965				 * than type-0.
966				 * Note that if the segment left field
967				 * is 0, all intermediate hops must
968				 * have been passed.
969				 */
970				if (rth->ip6r_segleft &&
971				    rth->ip6r_type == IPV6_RTHDR_TYPE_0) {
972					int hops;
973
974#ifndef PULLDOWN_TEST
975					IP6_EXTHDR_CHECK(m, 0, eoff + rthlen, -1);
976					rth0 = (struct ip6_rthdr0 *)
977					    (mtod(m, caddr_t) + eoff);
978#else
979					IP6_EXTHDR_GET(rth0,
980					    struct ip6_rthdr0 *, m,
981					    eoff, rthlen);
982					if (rth0 == NULL) {
983						icmp6stat.icp6s_tooshort++;
984						return (-1);
985					}
986#endif
987					/* just ignore a bogus header */
988					if ((rth0->ip6r0_len % 2) == 0 &&
989					    (hops = rth0->ip6r0_len/2))
990						finaldst = (struct in6_addr *)(rth0 + 1) + (hops - 1);
991				}
992				eoff += rthlen;
993				nxt = rth->ip6r_nxt;
994				break;
995			case IPPROTO_FRAGMENT:
996#ifndef PULLDOWN_TEST
997				IP6_EXTHDR_CHECK(m, 0, eoff +
998				    sizeof(struct ip6_frag), -1);
999				fh = (struct ip6_frag *)(mtod(m, caddr_t) +
1000				    eoff);
1001#else
1002				IP6_EXTHDR_GET(fh, struct ip6_frag *, m,
1003				    eoff, sizeof(*fh));
1004				if (fh == NULL) {
1005					icmp6stat.icp6s_tooshort++;
1006					return (-1);
1007				}
1008#endif
1009				/*
1010				 * Data after a fragment header is meaningless
1011				 * unless it is the first fragment, but
1012				 * we'll go to the notify label for path MTU
1013				 * discovery.
1014				 */
1015				if (fh->ip6f_offlg & IP6F_OFF_MASK)
1016					goto notify;
1017
1018				eoff += sizeof(struct ip6_frag);
1019				nxt = fh->ip6f_nxt;
1020				break;
1021			default:
1022				/*
1023				 * This case includes ESP and the No Next
1024				 * Header.  In such cases going to the notify
1025				 * label does not have any meaning
1026				 * (i.e. ctlfunc will be NULL), but we go
1027				 * anyway since we might have to update
1028				 * path MTU information.
1029				 */
1030				goto notify;
1031			}
1032		}
1033	  notify:
1034#ifndef PULLDOWN_TEST
1035		icmp6 = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
1036#else
1037		IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off,
1038		    sizeof(*icmp6) + sizeof(struct ip6_hdr));
1039		if (icmp6 == NULL) {
1040			icmp6stat.icp6s_tooshort++;
1041			return (-1);
1042		}
1043#endif
1044
1045		/*
1046		 * retrieve parameters from the inner IPv6 header, and convert
1047		 * them into sockaddr structures.
1048		 * XXX: there is no guarantee that the source or destination
1049		 * addresses of the inner packet are in the same scope as
1050		 * the addresses of the icmp packet.  But there is no other
1051		 * way to determine the zone.
1052		 */
1053		eip6 = (struct ip6_hdr *)(icmp6 + 1);
1054
1055		bzero(&icmp6dst, sizeof(icmp6dst));
1056		icmp6dst.sin6_len = sizeof(struct sockaddr_in6);
1057		icmp6dst.sin6_family = AF_INET6;
1058		if (finaldst == NULL)
1059			icmp6dst.sin6_addr = eip6->ip6_dst;
1060		else
1061			icmp6dst.sin6_addr = *finaldst;
1062		if (in6_addr2zoneid(m->m_pkthdr.rcvif, &icmp6dst.sin6_addr,
1063		    &icmp6dst.sin6_scope_id))
1064			goto freeit;
1065		if (in6_embedscope(&icmp6dst.sin6_addr, &icmp6dst,
1066				   NULL, NULL)) {
1067			/* should be impossbile */
1068			nd6log((LOG_DEBUG,
1069			    "icmp6_notify_error: in6_embedscope failed\n"));
1070			goto freeit;
1071		}
1072
1073		/*
1074		 * retrieve parameters from the inner IPv6 header, and convert
1075		 * them into sockaddr structures.
1076		 */
1077		bzero(&icmp6src, sizeof(icmp6src));
1078		icmp6src.sin6_len = sizeof(struct sockaddr_in6);
1079		icmp6src.sin6_family = AF_INET6;
1080		icmp6src.sin6_addr = eip6->ip6_src;
1081		if (in6_addr2zoneid(m->m_pkthdr.rcvif, &icmp6src.sin6_addr,
1082		    &icmp6src.sin6_scope_id)) {
1083			goto freeit;
1084		}
1085		if (in6_embedscope(&icmp6src.sin6_addr, &icmp6src,
1086				   NULL, NULL)) {
1087			/* should be impossbile */
1088			nd6log((LOG_DEBUG,
1089			    "icmp6_notify_error: in6_embedscope failed\n"));
1090			goto freeit;
1091		}
1092		icmp6src.sin6_flowinfo = (eip6->ip6_flow & IPV6_FLOWLABEL_MASK);
1093
1094		if (finaldst == NULL)
1095			finaldst = &eip6->ip6_dst;
1096		ip6cp.ip6c_m = m;
1097		ip6cp.ip6c_icmp6 = icmp6;
1098		ip6cp.ip6c_ip6 = (struct ip6_hdr *)(icmp6 + 1);
1099		ip6cp.ip6c_off = eoff;
1100		ip6cp.ip6c_finaldst = finaldst;
1101		ip6cp.ip6c_src = &icmp6src;
1102		ip6cp.ip6c_nxt = nxt;
1103
1104		if (icmp6type == ICMP6_PACKET_TOO_BIG) {
1105			notifymtu = ntohl(icmp6->icmp6_mtu);
1106			ip6cp.ip6c_cmdarg = (void *)&notifymtu;
1107			icmp6_mtudisc_update(&ip6cp, 1);	/*XXX*/
1108		}
1109
1110		ctlfunc = (void (*) __P((int, struct sockaddr *, void *)))
1111		    (inet6sw[ip6_protox[nxt]].pr_ctlinput);
1112		if (ctlfunc) {
1113			(void) (*ctlfunc)(code, (struct sockaddr *)&icmp6dst,
1114			    &ip6cp);
1115		}
1116	}
1117	return (0);
1118
1119  freeit:
1120	m_freem(m);
1121	return (-1);
1122}
1123
1124void
1125icmp6_mtudisc_update(ip6cp, validated)
1126	struct ip6ctlparam *ip6cp;
1127	int validated;
1128{
1129	struct in6_addr *dst = ip6cp->ip6c_finaldst;
1130	struct icmp6_hdr *icmp6 = ip6cp->ip6c_icmp6;
1131	struct mbuf *m = ip6cp->ip6c_m;	/* will be necessary for scope issue */
1132	u_int mtu = ntohl(icmp6->icmp6_mtu);
1133	struct rtentry *rt = NULL;
1134	struct sockaddr_in6 sin6;
1135
1136	if (!validated)
1137		return;
1138
1139	bzero(&sin6, sizeof(sin6));
1140	sin6.sin6_family = PF_INET6;
1141	sin6.sin6_len = sizeof(struct sockaddr_in6);
1142	sin6.sin6_addr = *dst;
1143	/* XXX normally, this won't happen */
1144	if (IN6_IS_ADDR_LINKLOCAL(dst)) {
1145		sin6.sin6_addr.s6_addr16[1] =
1146		    htons(m->m_pkthdr.rcvif->if_index);
1147	}
1148	/* sin6.sin6_scope_id = XXX: should be set if DST is a scoped addr */
1149	rt = rtalloc1((struct sockaddr *)&sin6, 0,
1150		      RTF_CLONING | RTF_PRCLONING);
1151
1152	if (rt && (rt->rt_flags & RTF_HOST) &&
1153	    !(rt->rt_rmx.rmx_locks & RTV_MTU)) {
1154		if (mtu < IPV6_MMTU) {
1155				/* xxx */
1156			rt->rt_rmx.rmx_locks |= RTV_MTU;
1157		} else if (mtu < rt->rt_ifp->if_mtu &&
1158			   rt->rt_rmx.rmx_mtu > mtu) {
1159			icmp6stat.icp6s_pmtuchg++;
1160			rt->rt_rmx.rmx_mtu = mtu;
1161		}
1162	}
1163	if (rt)
1164		rtfree(rt);
1165}
1166
1167/*
1168 * Process a Node Information Query packet, based on
1169 * draft-ietf-ipngwg-icmp-name-lookups-07.
1170 *
1171 * Spec incompatibilities:
1172 * - IPv6 Subject address handling
1173 * - IPv4 Subject address handling support missing
1174 * - Proxy reply (answer even if it's not for me)
1175 * - joins NI group address at in6_ifattach() time only, does not cope
1176 *   with hostname changes by sethostname(3)
1177 */
1178#define hostnamelen	strlen(hostname)
1179static struct mbuf *
1180ni6_input(m, off)
1181	struct mbuf *m;
1182	int off;
1183{
1184	struct icmp6_nodeinfo *ni6, *nni6;
1185	struct mbuf *n = NULL;
1186	u_int16_t qtype;
1187	int subjlen;
1188	int replylen = sizeof(struct ip6_hdr) + sizeof(struct icmp6_nodeinfo);
1189	struct ni_reply_fqdn *fqdn;
1190	int addrs;		/* for NI_QTYPE_NODEADDR */
1191	struct ifnet *ifp = NULL; /* for NI_QTYPE_NODEADDR */
1192	struct sockaddr_in6 sin6; /* double meaning; ip6_dst and subjectaddr */
1193	struct sockaddr_in6 sin6_d; /* XXX: we should retrieve this from m_aux */
1194	struct ip6_hdr *ip6;
1195	int oldfqdn = 0;	/* if 1, return pascal string (03 draft) */
1196	char *subj = NULL;
1197	struct in6_ifaddr *ia6 = NULL;
1198
1199	ip6 = mtod(m, struct ip6_hdr *);
1200#ifndef PULLDOWN_TEST
1201	ni6 = (struct icmp6_nodeinfo *)(mtod(m, caddr_t) + off);
1202#else
1203	IP6_EXTHDR_GET(ni6, struct icmp6_nodeinfo *, m, off, sizeof(*ni6));
1204	if (ni6 == NULL) {
1205		/* m is already reclaimed */
1206		return (NULL);
1207	}
1208#endif
1209
1210	/*
1211	 * Validate IPv6 destination address.
1212	 *
1213	 * The Responder must discard the Query without further processing
1214	 * unless it is one of the Responder's unicast or anycast addresses, or
1215	 * a link-local scope multicast address which the Responder has joined.
1216	 * [icmp-name-lookups-07, Section 4.]
1217	 */
1218	bzero(&sin6, sizeof(sin6));
1219	sin6.sin6_family = AF_INET6;
1220	sin6.sin6_len = sizeof(struct sockaddr_in6);
1221	bcopy(&ip6->ip6_dst, &sin6.sin6_addr, sizeof(sin6.sin6_addr));
1222	/* XXX scopeid */
1223	if ((ia6 = (struct in6_ifaddr *)ifa_ifwithaddr((struct sockaddr *)&sin6)) != NULL) {
1224		/* unicast/anycast, fine */
1225		if ((ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
1226		    (icmp6_nodeinfo & 4) == 0) {
1227			nd6log((LOG_DEBUG, "ni6_input: ignore node info to "
1228				"a temporary address in %s:%d",
1229			       __FILE__, __LINE__));
1230			goto bad;
1231		}
1232	} else if (IN6_IS_ADDR_MC_LINKLOCAL(&sin6.sin6_addr))
1233		; /* link-local multicast, fine */
1234	else
1235		goto bad;
1236
1237	/* validate query Subject field. */
1238	qtype = ntohs(ni6->ni_qtype);
1239	subjlen = m->m_pkthdr.len - off - sizeof(struct icmp6_nodeinfo);
1240	switch (qtype) {
1241	case NI_QTYPE_NOOP:
1242	case NI_QTYPE_SUPTYPES:
1243		/* 07 draft */
1244		if (ni6->ni_code == ICMP6_NI_SUBJ_FQDN && subjlen == 0)
1245			break;
1246		/* FALLTHROUGH */
1247	case NI_QTYPE_FQDN:
1248	case NI_QTYPE_NODEADDR:
1249		switch (ni6->ni_code) {
1250		case ICMP6_NI_SUBJ_IPV6:
1251#if ICMP6_NI_SUBJ_IPV6 != 0
1252		case 0:
1253#endif
1254			/*
1255			 * backward compatibility - try to accept 03 draft
1256			 * format, where no Subject is present.
1257			 */
1258			if (qtype == NI_QTYPE_FQDN && ni6->ni_code == 0 &&
1259			    subjlen == 0) {
1260				oldfqdn++;
1261				break;
1262			}
1263#if ICMP6_NI_SUBJ_IPV6 != 0
1264			if (ni6->ni_code != ICMP6_NI_SUBJ_IPV6)
1265				goto bad;
1266#endif
1267
1268			if (subjlen != sizeof(sin6.sin6_addr))
1269				goto bad;
1270
1271			/*
1272			 * Validate Subject address.
1273			 *
1274			 * Not sure what exactly "address belongs to the node"
1275			 * means in the spec, is it just unicast, or what?
1276			 *
1277			 * At this moment we consider Subject address as
1278			 * "belong to the node" if the Subject address equals
1279			 * to the IPv6 destination address; validation for
1280			 * IPv6 destination address should have done enough
1281			 * check for us.
1282			 *
1283			 * We do not do proxy at this moment.
1284			 */
1285			/* m_pulldown instead of copy? */
1286			m_copydata(m, off + sizeof(struct icmp6_nodeinfo),
1287			    subjlen, (caddr_t)&sin6.sin6_addr);
1288			if (in6_addr2zoneid(m->m_pkthdr.rcvif,
1289			    &sin6.sin6_addr, &sin6.sin6_scope_id)) {
1290				goto bad;
1291			}
1292			in6_embedscope(&sin6.sin6_addr, &sin6, NULL, NULL);
1293			bzero(&sin6_d, sizeof(sin6_d));
1294			sin6_d.sin6_family = AF_INET6; /* not used, actually */
1295			sin6_d.sin6_len = sizeof(sin6_d); /* ditto */
1296			sin6_d.sin6_addr = ip6->ip6_dst;
1297			if (in6_addr2zoneid(m->m_pkthdr.rcvif,
1298			    &ip6->ip6_dst, &sin6_d.sin6_scope_id)) {
1299				goto bad;
1300			}
1301			in6_embedscope(&sin6_d.sin6_addr, &sin6_d, NULL, NULL);
1302			subj = (char *)&sin6;
1303			if (SA6_ARE_ADDR_EQUAL(&sin6, &sin6_d))
1304				break;
1305
1306			/*
1307			 * XXX if we are to allow other cases, we should really
1308			 * be careful about scope here.
1309			 * basically, we should disallow queries toward IPv6
1310			 * destination X with subject Y,
1311			 * if scope(X) > scope(Y).
1312			 * if we allow scope(X) > scope(Y), it will result in
1313			 * information leakage across scope boundary.
1314			 */
1315			goto bad;
1316
1317		case ICMP6_NI_SUBJ_FQDN:
1318			/*
1319			 * Validate Subject name with gethostname(3).
1320			 *
1321			 * The behavior may need some debate, since:
1322			 * - we are not sure if the node has FQDN as
1323			 *   hostname (returned by gethostname(3)).
1324			 * - the code does wildcard match for truncated names.
1325			 *   however, we are not sure if we want to perform
1326			 *   wildcard match, if gethostname(3) side has
1327			 *   truncated hostname.
1328			 */
1329			n = ni6_nametodns(hostname, hostnamelen, 0);
1330			if (!n || n->m_next || n->m_len == 0)
1331				goto bad;
1332			IP6_EXTHDR_GET(subj, char *, m,
1333			    off + sizeof(struct icmp6_nodeinfo), subjlen);
1334			if (subj == NULL)
1335				goto bad;
1336			if (!ni6_dnsmatch(subj, subjlen, mtod(n, const char *),
1337			    n->m_len)) {
1338				goto bad;
1339			}
1340			m_freem(n);
1341			n = NULL;
1342			break;
1343
1344		case ICMP6_NI_SUBJ_IPV4:	/* XXX: to be implemented? */
1345		default:
1346			goto bad;
1347		}
1348		break;
1349	}
1350
1351	/* refuse based on configuration.  XXX ICMP6_NI_REFUSED? */
1352	switch (qtype) {
1353	case NI_QTYPE_FQDN:
1354		if ((icmp6_nodeinfo & 1) == 0)
1355			goto bad;
1356		break;
1357	case NI_QTYPE_NODEADDR:
1358		if ((icmp6_nodeinfo & 2) == 0)
1359			goto bad;
1360		break;
1361	}
1362
1363	/* guess reply length */
1364	switch (qtype) {
1365	case NI_QTYPE_NOOP:
1366		break;		/* no reply data */
1367	case NI_QTYPE_SUPTYPES:
1368		replylen += sizeof(u_int32_t);
1369		break;
1370	case NI_QTYPE_FQDN:
1371		/* XXX will append an mbuf */
1372		replylen += offsetof(struct ni_reply_fqdn, ni_fqdn_namelen);
1373		break;
1374	case NI_QTYPE_NODEADDR:
1375		addrs = ni6_addrs(ni6, m, &ifp, subj);
1376		if ((replylen += addrs * (sizeof(struct in6_addr) +
1377		    sizeof(u_int32_t))) > MCLBYTES)
1378			replylen = MCLBYTES; /* XXX: will truncate pkt later */
1379		break;
1380	default:
1381		/*
1382		 * XXX: We must return a reply with the ICMP6 code
1383		 * `unknown Qtype' in this case.  However we regard the case
1384		 * as an FQDN query for backward compatibility.
1385		 * Older versions set a random value to this field,
1386		 * so it rarely varies in the defined qtypes.
1387		 * But the mechanism is not reliable...
1388		 * maybe we should obsolete older versions.
1389		 */
1390		qtype = NI_QTYPE_FQDN;
1391		/* XXX will append an mbuf */
1392		replylen += offsetof(struct ni_reply_fqdn, ni_fqdn_namelen);
1393		oldfqdn++;
1394		break;
1395	}
1396
1397	/* allocate an mbuf to reply. */
1398	MGETHDR(n, M_DONTWAIT, m->m_type);
1399	if (n == NULL) {
1400		m_freem(m);
1401		return (NULL);
1402	}
1403	M_MOVE_PKTHDR(n, m); /* just for recvif */
1404	if (replylen > MHLEN) {
1405		if (replylen > MCLBYTES) {
1406			/*
1407			 * XXX: should we try to allocate more? But MCLBYTES
1408			 * is probably much larger than IPV6_MMTU...
1409			 */
1410			goto bad;
1411		}
1412		MCLGET(n, M_DONTWAIT);
1413		if ((n->m_flags & M_EXT) == 0) {
1414			goto bad;
1415		}
1416	}
1417	n->m_pkthdr.len = n->m_len = replylen;
1418
1419	/* copy mbuf header and IPv6 + Node Information base headers */
1420	bcopy(mtod(m, caddr_t), mtod(n, caddr_t), sizeof(struct ip6_hdr));
1421	nni6 = (struct icmp6_nodeinfo *)(mtod(n, struct ip6_hdr *) + 1);
1422	bcopy((caddr_t)ni6, (caddr_t)nni6, sizeof(struct icmp6_nodeinfo));
1423
1424	/* qtype dependent procedure */
1425	switch (qtype) {
1426	case NI_QTYPE_NOOP:
1427		nni6->ni_code = ICMP6_NI_SUCCESS;
1428		nni6->ni_flags = 0;
1429		break;
1430	case NI_QTYPE_SUPTYPES:
1431	{
1432		u_int32_t v;
1433		nni6->ni_code = ICMP6_NI_SUCCESS;
1434		nni6->ni_flags = htons(0x0000);	/* raw bitmap */
1435		/* supports NOOP, SUPTYPES, FQDN, and NODEADDR */
1436		v = (u_int32_t)htonl(0x0000000f);
1437		bcopy(&v, nni6 + 1, sizeof(u_int32_t));
1438		break;
1439	}
1440	case NI_QTYPE_FQDN:
1441		nni6->ni_code = ICMP6_NI_SUCCESS;
1442		fqdn = (struct ni_reply_fqdn *)(mtod(n, caddr_t) +
1443		    sizeof(struct ip6_hdr) + sizeof(struct icmp6_nodeinfo));
1444		nni6->ni_flags = 0; /* XXX: meaningless TTL */
1445		fqdn->ni_fqdn_ttl = 0;	/* ditto. */
1446		/*
1447		 * XXX do we really have FQDN in variable "hostname"?
1448		 */
1449		n->m_next = ni6_nametodns(hostname, hostnamelen, oldfqdn);
1450		if (n->m_next == NULL)
1451			goto bad;
1452		/* XXX we assume that n->m_next is not a chain */
1453		if (n->m_next->m_next != NULL)
1454			goto bad;
1455		n->m_pkthdr.len += n->m_next->m_len;
1456		break;
1457	case NI_QTYPE_NODEADDR:
1458	{
1459		int lenlim, copied;
1460
1461		nni6->ni_code = ICMP6_NI_SUCCESS;
1462		n->m_pkthdr.len = n->m_len =
1463		    sizeof(struct ip6_hdr) + sizeof(struct icmp6_nodeinfo);
1464		lenlim = M_TRAILINGSPACE(n);
1465		copied = ni6_store_addrs(ni6, nni6, ifp, lenlim);
1466		/* XXX: reset mbuf length */
1467		n->m_pkthdr.len = n->m_len = sizeof(struct ip6_hdr) +
1468		    sizeof(struct icmp6_nodeinfo) + copied;
1469		break;
1470	}
1471	default:
1472		break;		/* XXX impossible! */
1473	}
1474
1475	nni6->ni_type = ICMP6_NI_REPLY;
1476	m_freem(m);
1477	return (n);
1478
1479  bad:
1480	m_freem(m);
1481	if (n)
1482		m_freem(n);
1483	return (NULL);
1484}
1485#undef hostnamelen
1486
1487/*
1488 * make a mbuf with DNS-encoded string.  no compression support.
1489 *
1490 * XXX names with less than 2 dots (like "foo" or "foo.section") will be
1491 * treated as truncated name (two \0 at the end).  this is a wild guess.
1492 */
1493static struct mbuf *
1494ni6_nametodns(name, namelen, old)
1495	const char *name;
1496	int namelen;
1497	int old;	/* return pascal string if non-zero */
1498{
1499	struct mbuf *m;
1500	char *cp, *ep;
1501	const char *p, *q;
1502	int i, len, nterm;
1503
1504	if (old)
1505		len = namelen + 1;
1506	else
1507		len = MCLBYTES;
1508
1509	/* because MAXHOSTNAMELEN is usually 256, we use cluster mbuf */
1510	MGET(m, M_DONTWAIT, MT_DATA);
1511	if (m && len > MLEN) {
1512		MCLGET(m, M_DONTWAIT);
1513		if ((m->m_flags & M_EXT) == 0)
1514			goto fail;
1515	}
1516	if (!m)
1517		goto fail;
1518	m->m_next = NULL;
1519
1520	if (old) {
1521		m->m_len = len;
1522		*mtod(m, char *) = namelen;
1523		bcopy(name, mtod(m, char *) + 1, namelen);
1524		return m;
1525	} else {
1526		m->m_len = 0;
1527		cp = mtod(m, char *);
1528		ep = mtod(m, char *) + M_TRAILINGSPACE(m);
1529
1530		/* if not certain about my name, return empty buffer */
1531		if (namelen == 0)
1532			return m;
1533
1534		/*
1535		 * guess if it looks like shortened hostname, or FQDN.
1536		 * shortened hostname needs two trailing "\0".
1537		 */
1538		i = 0;
1539		for (p = name; p < name + namelen; p++) {
1540			if (*p && *p == '.')
1541				i++;
1542		}
1543		if (i < 2)
1544			nterm = 2;
1545		else
1546			nterm = 1;
1547
1548		p = name;
1549		while (cp < ep && p < name + namelen) {
1550			i = 0;
1551			for (q = p; q < name + namelen && *q && *q != '.'; q++)
1552				i++;
1553			/* result does not fit into mbuf */
1554			if (cp + i + 1 >= ep)
1555				goto fail;
1556			/*
1557			 * DNS label length restriction, RFC1035 page 8.
1558			 * "i == 0" case is included here to avoid returning
1559			 * 0-length label on "foo..bar".
1560			 */
1561			if (i <= 0 || i >= 64)
1562				goto fail;
1563			*cp++ = i;
1564			bcopy(p, cp, i);
1565			cp += i;
1566			p = q;
1567			if (p < name + namelen && *p == '.')
1568				p++;
1569		}
1570		/* termination */
1571		if (cp + nterm >= ep)
1572			goto fail;
1573		while (nterm-- > 0)
1574			*cp++ = '\0';
1575		m->m_len = cp - mtod(m, char *);
1576		return m;
1577	}
1578
1579	panic("should not reach here");
1580	/* NOTREACHED */
1581
1582 fail:
1583	if (m)
1584		m_freem(m);
1585	return NULL;
1586}
1587
1588/*
1589 * check if two DNS-encoded string matches.  takes care of truncated
1590 * form (with \0\0 at the end).  no compression support.
1591 * XXX upper/lowercase match (see RFC2065)
1592 */
1593static int
1594ni6_dnsmatch(a, alen, b, blen)
1595	const char *a;
1596	int alen;
1597	const char *b;
1598	int blen;
1599{
1600	const char *a0, *b0;
1601	int l;
1602
1603	/* simplest case - need validation? */
1604	if (alen == blen && bcmp(a, b, alen) == 0)
1605		return 1;
1606
1607	a0 = a;
1608	b0 = b;
1609
1610	/* termination is mandatory */
1611	if (alen < 2 || blen < 2)
1612		return 0;
1613	if (a0[alen - 1] != '\0' || b0[blen - 1] != '\0')
1614		return 0;
1615	alen--;
1616	blen--;
1617
1618	while (a - a0 < alen && b - b0 < blen) {
1619		if (a - a0 + 1 > alen || b - b0 + 1 > blen)
1620			return 0;
1621
1622		if ((signed char)a[0] < 0 || (signed char)b[0] < 0)
1623			return 0;
1624		/* we don't support compression yet */
1625		if (a[0] >= 64 || b[0] >= 64)
1626			return 0;
1627
1628		/* truncated case */
1629		if (a[0] == 0 && a - a0 == alen - 1)
1630			return 1;
1631		if (b[0] == 0 && b - b0 == blen - 1)
1632			return 1;
1633		if (a[0] == 0 || b[0] == 0)
1634			return 0;
1635
1636		if (a[0] != b[0])
1637			return 0;
1638		l = a[0];
1639		if (a - a0 + 1 + l > alen || b - b0 + 1 + l > blen)
1640			return 0;
1641		if (bcmp(a + 1, b + 1, l) != 0)
1642			return 0;
1643
1644		a += 1 + l;
1645		b += 1 + l;
1646	}
1647
1648	if (a - a0 == alen && b - b0 == blen)
1649		return 1;
1650	else
1651		return 0;
1652}
1653
1654/*
1655 * calculate the number of addresses to be returned in the node info reply.
1656 */
1657static int
1658ni6_addrs(ni6, m, ifpp, subj)
1659	struct icmp6_nodeinfo *ni6;
1660	struct mbuf *m;
1661	struct ifnet **ifpp;
1662	char *subj;
1663{
1664	struct ifnet *ifp;
1665	struct in6_ifaddr *ifa6;
1666	struct ifaddr *ifa;
1667	struct sockaddr_in6 *subj_ip6 = NULL; /* XXX pedant */
1668	int addrs = 0, addrsofif, iffound = 0;
1669	int niflags = ni6->ni_flags;
1670
1671	if ((niflags & NI_NODEADDR_FLAG_ALL) == 0) {
1672		switch (ni6->ni_code) {
1673		case ICMP6_NI_SUBJ_IPV6:
1674			if (subj == NULL) /* must be impossible... */
1675				return (0);
1676			subj_ip6 = (struct sockaddr_in6 *)subj;
1677			break;
1678		default:
1679			/*
1680			 * XXX: we only support IPv6 subject address for
1681			 * this Qtype.
1682			 */
1683			return (0);
1684		}
1685	}
1686
1687	IFNET_RLOCK();
1688	for (ifp = TAILQ_FIRST(&ifnet); ifp; ifp = TAILQ_NEXT(ifp, if_list)) {
1689		addrsofif = 0;
1690		TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
1691			if (ifa->ifa_addr->sa_family != AF_INET6)
1692				continue;
1693			ifa6 = (struct in6_ifaddr *)ifa;
1694
1695			if ((niflags & NI_NODEADDR_FLAG_ALL) == 0 &&
1696			    IN6_ARE_ADDR_EQUAL(&subj_ip6->sin6_addr,
1697			    &ifa6->ia_addr.sin6_addr))
1698				iffound = 1;
1699
1700			/*
1701			 * IPv4-mapped addresses can only be returned by a
1702			 * Node Information proxy, since they represent
1703			 * addresses of IPv4-only nodes, which perforce do
1704			 * not implement this protocol.
1705			 * [icmp-name-lookups-07, Section 5.4]
1706			 * So we don't support NI_NODEADDR_FLAG_COMPAT in
1707			 * this function at this moment.
1708			 */
1709
1710			/* What do we have to do about ::1? */
1711			switch (in6_addrscope(&ifa6->ia_addr.sin6_addr)) {
1712			case IPV6_ADDR_SCOPE_LINKLOCAL:
1713				if ((niflags & NI_NODEADDR_FLAG_LINKLOCAL) == 0)
1714					continue;
1715				break;
1716			case IPV6_ADDR_SCOPE_SITELOCAL:
1717				if ((niflags & NI_NODEADDR_FLAG_SITELOCAL) == 0)
1718					continue;
1719				break;
1720			case IPV6_ADDR_SCOPE_GLOBAL:
1721				if ((niflags & NI_NODEADDR_FLAG_GLOBAL) == 0)
1722					continue;
1723				break;
1724			default:
1725				continue;
1726			}
1727
1728			/*
1729			 * check if anycast is okay.
1730			 * XXX: just experimental.  not in the spec.
1731			 */
1732			if ((ifa6->ia6_flags & IN6_IFF_ANYCAST) != 0 &&
1733			    (niflags & NI_NODEADDR_FLAG_ANYCAST) == 0)
1734				continue; /* we need only unicast addresses */
1735			if ((ifa6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
1736			    (icmp6_nodeinfo & 4) == 0) {
1737				continue;
1738			}
1739			addrsofif++; /* count the address */
1740		}
1741		if (iffound) {
1742			*ifpp = ifp;
1743			IFNET_RUNLOCK();
1744			return (addrsofif);
1745		}
1746
1747		addrs += addrsofif;
1748	}
1749	IFNET_RUNLOCK();
1750
1751	return (addrs);
1752}
1753
1754static int
1755ni6_store_addrs(ni6, nni6, ifp0, resid)
1756	struct icmp6_nodeinfo *ni6, *nni6;
1757	struct ifnet *ifp0;
1758	int resid;
1759{
1760	struct ifnet *ifp = ifp0 ? ifp0 : TAILQ_FIRST(&ifnet);
1761	struct in6_ifaddr *ifa6;
1762	struct ifaddr *ifa;
1763	struct ifnet *ifp_dep = NULL;
1764	int copied = 0, allow_deprecated = 0;
1765	u_char *cp = (u_char *)(nni6 + 1);
1766	int niflags = ni6->ni_flags;
1767	u_int32_t ltime;
1768
1769	if (ifp0 == NULL && !(niflags & NI_NODEADDR_FLAG_ALL))
1770		return (0);	/* needless to copy */
1771
1772	IFNET_RLOCK();
1773  again:
1774
1775	for (; ifp; ifp = TAILQ_NEXT(ifp, if_list)) {
1776		for (ifa = ifp->if_addrlist.tqh_first; ifa;
1777		     ifa = ifa->ifa_list.tqe_next) {
1778			if (ifa->ifa_addr->sa_family != AF_INET6)
1779				continue;
1780			ifa6 = (struct in6_ifaddr *)ifa;
1781
1782			if ((ifa6->ia6_flags & IN6_IFF_DEPRECATED) != 0 &&
1783			    allow_deprecated == 0) {
1784				/*
1785				 * prefererred address should be put before
1786				 * deprecated addresses.
1787				 */
1788
1789				/* record the interface for later search */
1790				if (ifp_dep == NULL)
1791					ifp_dep = ifp;
1792
1793				continue;
1794			} else if ((ifa6->ia6_flags & IN6_IFF_DEPRECATED) == 0 &&
1795			    allow_deprecated != 0)
1796				continue; /* we now collect deprecated addrs */
1797
1798			/* What do we have to do about ::1? */
1799			switch (in6_addrscope(&ifa6->ia_addr.sin6_addr)) {
1800			case IPV6_ADDR_SCOPE_LINKLOCAL:
1801				if ((niflags & NI_NODEADDR_FLAG_LINKLOCAL) == 0)
1802					continue;
1803				break;
1804			case IPV6_ADDR_SCOPE_SITELOCAL:
1805				if ((niflags & NI_NODEADDR_FLAG_SITELOCAL) == 0)
1806					continue;
1807				break;
1808			case IPV6_ADDR_SCOPE_GLOBAL:
1809				if ((niflags & NI_NODEADDR_FLAG_GLOBAL) == 0)
1810					continue;
1811				break;
1812			default:
1813				continue;
1814			}
1815
1816			/*
1817			 * check if anycast is okay.
1818			 * XXX: just experimental.  not in the spec.
1819			 */
1820			if ((ifa6->ia6_flags & IN6_IFF_ANYCAST) != 0 &&
1821			    (niflags & NI_NODEADDR_FLAG_ANYCAST) == 0)
1822				continue;
1823			if ((ifa6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
1824			    (icmp6_nodeinfo & 4) == 0) {
1825				continue;
1826			}
1827
1828			/* now we can copy the address */
1829			if (resid < sizeof(struct in6_addr) +
1830			    sizeof(u_int32_t)) {
1831				/*
1832				 * We give up much more copy.
1833				 * Set the truncate flag and return.
1834				 */
1835				nni6->ni_flags |= NI_NODEADDR_FLAG_TRUNCATE;
1836				IFNET_RUNLOCK();
1837				return (copied);
1838			}
1839
1840			/*
1841			 * Set the TTL of the address.
1842			 * The TTL value should be one of the following
1843			 * according to the specification:
1844			 *
1845			 * 1. The remaining lifetime of a DHCP lease on the
1846			 *    address, or
1847			 * 2. The remaining Valid Lifetime of a prefix from
1848			 *    which the address was derived through Stateless
1849			 *    Autoconfiguration.
1850			 *
1851			 * Note that we currently do not support stateful
1852			 * address configuration by DHCPv6, so the former
1853			 * case can't happen.
1854			 */
1855			if (ifa6->ia6_lifetime.ia6t_expire == 0)
1856				ltime = ND6_INFINITE_LIFETIME;
1857			else {
1858				if (ifa6->ia6_lifetime.ia6t_expire >
1859				    time_second)
1860					ltime = htonl(ifa6->ia6_lifetime.ia6t_expire - time_second);
1861				else
1862					ltime = 0;
1863			}
1864
1865			bcopy(&ltime, cp, sizeof(u_int32_t));
1866			cp += sizeof(u_int32_t);
1867
1868			/* copy the address itself */
1869			bcopy(&ifa6->ia_addr.sin6_addr, cp,
1870			    sizeof(struct in6_addr));
1871			in6_clearscope((struct in6_addr *)cp); /* XXX */
1872			cp += sizeof(struct in6_addr);
1873
1874			resid -= (sizeof(struct in6_addr) + sizeof(u_int32_t));
1875			copied += (sizeof(struct in6_addr) + sizeof(u_int32_t));
1876		}
1877		if (ifp0)	/* we need search only on the specified IF */
1878			break;
1879	}
1880
1881	if (allow_deprecated == 0 && ifp_dep != NULL) {
1882		ifp = ifp_dep;
1883		allow_deprecated = 1;
1884
1885		goto again;
1886	}
1887
1888	IFNET_RUNLOCK();
1889
1890	return (copied);
1891}
1892
1893/*
1894 * XXX almost dup'ed code with rip6_input.
1895 */
1896static int
1897icmp6_rip6_input(mp, off)
1898	struct	mbuf **mp;
1899	int	off;
1900{
1901	struct mbuf *m = *mp;
1902	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1903	struct in6pcb *in6p;
1904	struct in6pcb *last = NULL;
1905	struct sockaddr_in6 fromsa;
1906	struct icmp6_hdr *icmp6;
1907	struct mbuf *opts = NULL;
1908
1909#ifndef PULLDOWN_TEST
1910	/* this is assumed to be safe. */
1911	icmp6 = (struct icmp6_hdr *)((caddr_t)ip6 + off);
1912#else
1913	IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off, sizeof(*icmp6));
1914	if (icmp6 == NULL) {
1915		/* m is already reclaimed */
1916		return (IPPROTO_DONE);
1917	}
1918#endif
1919
1920	bzero(&fromsa, sizeof(fromsa));
1921	fromsa.sin6_len = sizeof(struct sockaddr_in6);
1922	fromsa.sin6_family = AF_INET6;
1923	/* KAME hack: recover scopeid */
1924	(void)in6_recoverscope(&fromsa, &ip6->ip6_src, m->m_pkthdr.rcvif);
1925
1926	LIST_FOREACH(in6p, &ripcb, inp_list) {
1927		if ((in6p->inp_vflag & INP_IPV6) == 0)
1928			continue;
1929#ifdef HAVE_NRL_INPCB
1930		if (!(in6p->in6p_flags & INP_IPV6))
1931			continue;
1932#endif
1933		if (in6p->in6p_ip6_nxt != IPPROTO_ICMPV6)
1934			continue;
1935		if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr) &&
1936		   !IN6_ARE_ADDR_EQUAL(&in6p->in6p_laddr, &ip6->ip6_dst))
1937			continue;
1938		if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr) &&
1939		   !IN6_ARE_ADDR_EQUAL(&in6p->in6p_faddr, &ip6->ip6_src))
1940			continue;
1941		if (in6p->in6p_icmp6filt
1942		    && ICMP6_FILTER_WILLBLOCK(icmp6->icmp6_type,
1943				 in6p->in6p_icmp6filt))
1944			continue;
1945		if (last) {
1946			struct	mbuf *n;
1947			if ((n = m_copy(m, 0, (int)M_COPYALL)) != NULL) {
1948				if (last->in6p_flags & IN6P_CONTROLOPTS)
1949					ip6_savecontrol(last, &opts, ip6, n);
1950				/* strip intermediate headers */
1951				m_adj(n, off);
1952				if (sbappendaddr(&last->in6p_socket->so_rcv,
1953				    (struct sockaddr *)&fromsa, n, opts)
1954				    == 0) {
1955					/* should notify about lost packet */
1956					m_freem(n);
1957					if (opts) {
1958						m_freem(opts);
1959					}
1960				} else
1961					sorwakeup(last->in6p_socket);
1962				opts = NULL;
1963			}
1964		}
1965		last = in6p;
1966	}
1967	if (last) {
1968		if (last->in6p_flags & IN6P_CONTROLOPTS)
1969			ip6_savecontrol(last, &opts, ip6, m);
1970		/* strip intermediate headers */
1971		m_adj(m, off);
1972		if (sbappendaddr(&last->in6p_socket->so_rcv,
1973		    (struct sockaddr *)&fromsa, m, opts) == 0) {
1974			m_freem(m);
1975			if (opts)
1976				m_freem(opts);
1977		} else
1978			sorwakeup(last->in6p_socket);
1979	} else {
1980		m_freem(m);
1981		ip6stat.ip6s_delivered--;
1982	}
1983	return IPPROTO_DONE;
1984}
1985
1986/*
1987 * Reflect the ip6 packet back to the source.
1988 * OFF points to the icmp6 header, counted from the top of the mbuf.
1989 */
1990void
1991icmp6_reflect(m, off)
1992	struct	mbuf *m;
1993	size_t off;
1994{
1995	struct ip6_hdr *ip6;
1996	struct icmp6_hdr *icmp6;
1997	struct in6_ifaddr *ia;
1998	struct in6_addr t, *src = 0;
1999	int plen;
2000	int type, code;
2001	struct ifnet *outif = NULL;
2002	struct sockaddr_in6 sa6_src, sa6_dst;
2003#ifdef COMPAT_RFC1885
2004	int mtu = IPV6_MMTU;
2005	struct sockaddr_in6 *sin6 = &icmp6_reflect_rt.ro_dst;
2006#endif
2007
2008	/* too short to reflect */
2009	if (off < sizeof(struct ip6_hdr)) {
2010		nd6log((LOG_DEBUG,
2011		    "sanity fail: off=%lx, sizeof(ip6)=%lx in %s:%d\n",
2012		    (u_long)off, (u_long)sizeof(struct ip6_hdr),
2013		    __FILE__, __LINE__));
2014		goto bad;
2015	}
2016
2017	/*
2018	 * If there are extra headers between IPv6 and ICMPv6, strip
2019	 * off that header first.
2020	 */
2021#ifdef DIAGNOSTIC
2022	if (sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr) > MHLEN)
2023		panic("assumption failed in icmp6_reflect");
2024#endif
2025	if (off > sizeof(struct ip6_hdr)) {
2026		size_t l;
2027		struct ip6_hdr nip6;
2028
2029		l = off - sizeof(struct ip6_hdr);
2030		m_copydata(m, 0, sizeof(nip6), (caddr_t)&nip6);
2031		m_adj(m, l);
2032		l = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
2033		if (m->m_len < l) {
2034			if ((m = m_pullup(m, l)) == NULL)
2035				return;
2036		}
2037		bcopy((caddr_t)&nip6, mtod(m, caddr_t), sizeof(nip6));
2038	} else /* off == sizeof(struct ip6_hdr) */ {
2039		size_t l;
2040		l = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
2041		if (m->m_len < l) {
2042			if ((m = m_pullup(m, l)) == NULL)
2043				return;
2044		}
2045	}
2046	plen = m->m_pkthdr.len - sizeof(struct ip6_hdr);
2047	ip6 = mtod(m, struct ip6_hdr *);
2048	ip6->ip6_nxt = IPPROTO_ICMPV6;
2049	icmp6 = (struct icmp6_hdr *)(ip6 + 1);
2050	type = icmp6->icmp6_type; /* keep type for statistics */
2051	code = icmp6->icmp6_code; /* ditto. */
2052
2053	t = ip6->ip6_dst;
2054	/*
2055	 * ip6_input() drops a packet if its src is multicast.
2056	 * So, the src is never multicast.
2057	 */
2058	ip6->ip6_dst = ip6->ip6_src;
2059
2060	/*
2061	 * XXX: make sure to embed scope zone information, using
2062	 * already embedded IDs or the received interface (if any).
2063	 * Note that rcvif may be NULL.
2064	 * TODO: scoped routing case (XXX).
2065	 */
2066	bzero(&sa6_src, sizeof(sa6_src));
2067	sa6_src.sin6_family = AF_INET6;
2068	sa6_src.sin6_len = sizeof(sa6_src);
2069	sa6_src.sin6_addr = ip6->ip6_dst;
2070	in6_recoverscope(&sa6_src, &ip6->ip6_dst, m->m_pkthdr.rcvif);
2071	in6_embedscope(&ip6->ip6_dst, &sa6_src, NULL, NULL);
2072	bzero(&sa6_dst, sizeof(sa6_dst));
2073	sa6_dst.sin6_family = AF_INET6;
2074	sa6_dst.sin6_len = sizeof(sa6_dst);
2075	sa6_dst.sin6_addr = t;
2076	in6_recoverscope(&sa6_dst, &t, m->m_pkthdr.rcvif);
2077	in6_embedscope(&t, &sa6_dst, NULL, NULL);
2078
2079#ifdef COMPAT_RFC1885
2080	/*
2081	 * xxx guess MTU
2082	 * RFC 1885 requires that echo reply should be truncated if it
2083	 * does not fit in with (return) path MTU, but the description was
2084	 * removed in the new spec.
2085	 */
2086	if (icmp6_reflect_rt.ro_rt == 0 ||
2087	    ! (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr, &ip6->ip6_dst))) {
2088		if (icmp6_reflect_rt.ro_rt) {
2089			RTFREE(icmp6_reflect_rt.ro_rt);
2090			icmp6_reflect_rt.ro_rt = 0;
2091		}
2092		bzero(sin6, sizeof(*sin6));
2093		sin6->sin6_family = PF_INET6;
2094		sin6->sin6_len = sizeof(struct sockaddr_in6);
2095		sin6->sin6_addr = ip6->ip6_dst;
2096
2097		rtalloc_ign((struct route *)&icmp6_reflect_rt.ro_rt,
2098			    RTF_PRCLONING);
2099	}
2100
2101	if (icmp6_reflect_rt.ro_rt == 0)
2102		goto bad;
2103
2104	if ((icmp6_reflect_rt.ro_rt->rt_flags & RTF_HOST)
2105	    && mtu < icmp6_reflect_rt.ro_rt->rt_ifp->if_mtu)
2106		mtu = icmp6_reflect_rt.ro_rt->rt_rmx.rmx_mtu;
2107
2108	if (mtu < m->m_pkthdr.len) {
2109		plen -= (m->m_pkthdr.len - mtu);
2110		m_adj(m, mtu - m->m_pkthdr.len);
2111	}
2112#endif
2113	/*
2114	 * If the incoming packet was addressed directly to us (i.e. unicast),
2115	 * use dst as the src for the reply.
2116	 * The IN6_IFF_NOTREADY case should be VERY rare, but is possible
2117	 * (for example) when we encounter an error while forwarding procedure
2118	 * destined to a duplicated address of ours.
2119	 */
2120	for (ia = in6_ifaddr; ia; ia = ia->ia_next)
2121		if (IN6_ARE_ADDR_EQUAL(&t, &ia->ia_addr.sin6_addr) &&
2122		    (ia->ia6_flags & (IN6_IFF_ANYCAST|IN6_IFF_NOTREADY)) == 0) {
2123			src = &t;
2124			break;
2125		}
2126	if (ia == NULL && IN6_IS_ADDR_LINKLOCAL(&t) && (m->m_flags & M_LOOP)) {
2127		/*
2128		 * This is the case if the dst is our link-local address
2129		 * and the sender is also ourselves.
2130		 */
2131		src = &t;
2132	}
2133
2134	if (src == 0) {
2135		int e;
2136		struct route_in6 ro;
2137
2138		/*
2139		 * This case matches to multicasts, our anycast, or unicasts
2140		 * that we do not own.  Select a source address based on the
2141		 * source address of the erroneous packet.
2142		 */
2143		bzero(&ro, sizeof(ro));
2144		src = in6_selectsrc(&sa6_src, NULL, NULL, &ro, NULL, &e);
2145		if (ro.ro_rt)
2146			RTFREE(ro.ro_rt); /* XXX: we could use this */
2147		if (src == NULL) {
2148			nd6log((LOG_DEBUG,
2149			    "icmp6_reflect: source can't be determined: "
2150			    "dst=%s, error=%d\n",
2151			    ip6_sprintf(&sa6_src.sin6_addr), e));
2152			goto bad;
2153		}
2154	}
2155
2156	ip6->ip6_src = *src;
2157
2158	ip6->ip6_flow = 0;
2159	ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
2160	ip6->ip6_vfc |= IPV6_VERSION;
2161	ip6->ip6_nxt = IPPROTO_ICMPV6;
2162	if (m->m_pkthdr.rcvif) {
2163		/* XXX: This may not be the outgoing interface */
2164		ip6->ip6_hlim = ND_IFINFO(m->m_pkthdr.rcvif)->chlim;
2165	} else
2166		ip6->ip6_hlim = ip6_defhlim;
2167
2168	icmp6->icmp6_cksum = 0;
2169	icmp6->icmp6_cksum = in6_cksum(m, IPPROTO_ICMPV6,
2170	    sizeof(struct ip6_hdr), plen);
2171
2172	/*
2173	 * XXX option handling
2174	 */
2175
2176	m->m_flags &= ~(M_BCAST|M_MCAST);
2177
2178#ifdef COMPAT_RFC1885
2179	ip6_output(m, NULL, &icmp6_reflect_rt, 0, NULL, &outif, NULL);
2180#else
2181	ip6_output(m, NULL, NULL, 0, NULL, &outif, NULL);
2182#endif
2183	if (outif)
2184		icmp6_ifoutstat_inc(outif, type, code);
2185
2186	return;
2187
2188 bad:
2189	m_freem(m);
2190	return;
2191}
2192
2193void
2194icmp6_fasttimo()
2195{
2196
2197	mld6_fasttimeo();
2198}
2199
2200static const char *
2201icmp6_redirect_diag(src6, dst6, tgt6)
2202	struct in6_addr *src6;
2203	struct in6_addr *dst6;
2204	struct in6_addr *tgt6;
2205{
2206	static char buf[1024];
2207	snprintf(buf, sizeof(buf), "(src=%s dst=%s tgt=%s)",
2208	    ip6_sprintf(src6), ip6_sprintf(dst6), ip6_sprintf(tgt6));
2209	return buf;
2210}
2211
2212void
2213icmp6_redirect_input(m, off)
2214	struct mbuf *m;
2215	int off;
2216{
2217	struct ifnet *ifp = m->m_pkthdr.rcvif;
2218	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
2219	struct nd_redirect *nd_rd;
2220	int icmp6len = ntohs(ip6->ip6_plen);
2221	char *lladdr = NULL;
2222	int lladdrlen = 0;
2223	u_char *redirhdr = NULL;
2224	int redirhdrlen = 0;
2225	struct rtentry *rt = NULL;
2226	int is_router;
2227	int is_onlink;
2228	struct in6_addr src6 = ip6->ip6_src;
2229	struct in6_addr redtgt6;
2230	struct in6_addr reddst6;
2231	union nd_opts ndopts;
2232
2233	if (!m || !ifp)
2234		return;
2235
2236	/* XXX if we are router, we don't update route by icmp6 redirect */
2237	if (ip6_forwarding)
2238		goto freeit;
2239	if (!icmp6_rediraccept)
2240		goto freeit;
2241
2242#ifndef PULLDOWN_TEST
2243	IP6_EXTHDR_CHECK(m, off, icmp6len,);
2244	nd_rd = (struct nd_redirect *)((caddr_t)ip6 + off);
2245#else
2246	IP6_EXTHDR_GET(nd_rd, struct nd_redirect *, m, off, icmp6len);
2247	if (nd_rd == NULL) {
2248		icmp6stat.icp6s_tooshort++;
2249		return;
2250	}
2251#endif
2252	redtgt6 = nd_rd->nd_rd_target;
2253	reddst6 = nd_rd->nd_rd_dst;
2254
2255	if (IN6_IS_ADDR_LINKLOCAL(&redtgt6))
2256		redtgt6.s6_addr16[1] = htons(ifp->if_index);
2257	if (IN6_IS_ADDR_LINKLOCAL(&reddst6))
2258		reddst6.s6_addr16[1] = htons(ifp->if_index);
2259
2260	/* validation */
2261	if (!IN6_IS_ADDR_LINKLOCAL(&src6)) {
2262		nd6log((LOG_ERR,
2263		    "ICMP6 redirect sent from %s rejected; "
2264		    "must be from linklocal\n",
2265		    ip6_sprintf(&src6)));
2266		goto bad;
2267	}
2268	if (ip6->ip6_hlim != 255) {
2269		nd6log((LOG_ERR,
2270		    "ICMP6 redirect sent from %s rejected; "
2271		    "hlim=%d (must be 255)\n",
2272		    ip6_sprintf(&src6), ip6->ip6_hlim));
2273		goto bad;
2274	}
2275    {
2276	/* ip6->ip6_src must be equal to gw for icmp6->icmp6_reddst */
2277	struct sockaddr_in6 sin6;
2278	struct in6_addr *gw6;
2279
2280	bzero(&sin6, sizeof(sin6));
2281	sin6.sin6_family = AF_INET6;
2282	sin6.sin6_len = sizeof(struct sockaddr_in6);
2283	bcopy(&reddst6, &sin6.sin6_addr, sizeof(reddst6));
2284	rt = rtalloc1((struct sockaddr *)&sin6, 0, 0UL);
2285	if (rt) {
2286		if (rt->rt_gateway == NULL ||
2287		    rt->rt_gateway->sa_family != AF_INET6) {
2288			nd6log((LOG_ERR,
2289			    "ICMP6 redirect rejected; no route "
2290			    "with inet6 gateway found for redirect dst: %s\n",
2291			    icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
2292			RTFREE_LOCKED(rt);
2293			goto bad;
2294		}
2295
2296		gw6 = &(((struct sockaddr_in6 *)rt->rt_gateway)->sin6_addr);
2297		if (bcmp(&src6, gw6, sizeof(struct in6_addr)) != 0) {
2298			nd6log((LOG_ERR,
2299			    "ICMP6 redirect rejected; "
2300			    "not equal to gw-for-src=%s (must be same): "
2301			    "%s\n",
2302			    ip6_sprintf(gw6),
2303			    icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
2304			RTFREE_LOCKED(rt);
2305			goto bad;
2306		}
2307	} else {
2308		nd6log((LOG_ERR,
2309		    "ICMP6 redirect rejected; "
2310		    "no route found for redirect dst: %s\n",
2311		    icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
2312		goto bad;
2313	}
2314	RTFREE_LOCKED(rt);
2315	rt = NULL;
2316    }
2317	if (IN6_IS_ADDR_MULTICAST(&reddst6)) {
2318		nd6log((LOG_ERR,
2319		    "ICMP6 redirect rejected; "
2320		    "redirect dst must be unicast: %s\n",
2321		    icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
2322		goto bad;
2323	}
2324
2325	is_router = is_onlink = 0;
2326	if (IN6_IS_ADDR_LINKLOCAL(&redtgt6))
2327		is_router = 1;	/* router case */
2328	if (bcmp(&redtgt6, &reddst6, sizeof(redtgt6)) == 0)
2329		is_onlink = 1;	/* on-link destination case */
2330	if (!is_router && !is_onlink) {
2331		nd6log((LOG_ERR,
2332		    "ICMP6 redirect rejected; "
2333		    "neither router case nor onlink case: %s\n",
2334		    icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
2335		goto bad;
2336	}
2337	/* validation passed */
2338
2339	icmp6len -= sizeof(*nd_rd);
2340	nd6_option_init(nd_rd + 1, icmp6len, &ndopts);
2341	if (nd6_options(&ndopts) < 0) {
2342		nd6log((LOG_INFO, "icmp6_redirect_input: "
2343		    "invalid ND option, rejected: %s\n",
2344		    icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
2345		/* nd6_options have incremented stats */
2346		goto freeit;
2347	}
2348
2349	if (ndopts.nd_opts_tgt_lladdr) {
2350		lladdr = (char *)(ndopts.nd_opts_tgt_lladdr + 1);
2351		lladdrlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3;
2352	}
2353
2354	if (ndopts.nd_opts_rh) {
2355		redirhdrlen = ndopts.nd_opts_rh->nd_opt_rh_len;
2356		redirhdr = (u_char *)(ndopts.nd_opts_rh + 1); /* xxx */
2357	}
2358
2359	if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
2360		nd6log((LOG_INFO,
2361		    "icmp6_redirect_input: lladdrlen mismatch for %s "
2362		    "(if %d, icmp6 packet %d): %s\n",
2363		    ip6_sprintf(&redtgt6), ifp->if_addrlen, lladdrlen - 2,
2364		    icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
2365		goto bad;
2366	}
2367
2368	/* RFC 2461 8.3 */
2369	nd6_cache_lladdr(ifp, &redtgt6, lladdr, lladdrlen, ND_REDIRECT,
2370	    is_onlink ? ND_REDIRECT_ONLINK : ND_REDIRECT_ROUTER);
2371
2372	if (!is_onlink) {	/* better router case.  perform rtredirect. */
2373		/* perform rtredirect */
2374		struct sockaddr_in6 sdst;
2375		struct sockaddr_in6 sgw;
2376		struct sockaddr_in6 ssrc;
2377
2378		bzero(&sdst, sizeof(sdst));
2379		bzero(&sgw, sizeof(sgw));
2380		bzero(&ssrc, sizeof(ssrc));
2381		sdst.sin6_family = sgw.sin6_family = ssrc.sin6_family = AF_INET6;
2382		sdst.sin6_len = sgw.sin6_len = ssrc.sin6_len =
2383			sizeof(struct sockaddr_in6);
2384		bcopy(&redtgt6, &sgw.sin6_addr, sizeof(struct in6_addr));
2385		bcopy(&reddst6, &sdst.sin6_addr, sizeof(struct in6_addr));
2386		bcopy(&src6, &ssrc.sin6_addr, sizeof(struct in6_addr));
2387		rtredirect((struct sockaddr *)&sdst, (struct sockaddr *)&sgw,
2388		    (struct sockaddr *)NULL, RTF_GATEWAY | RTF_HOST,
2389		    (struct sockaddr *)&ssrc);
2390	}
2391	/* finally update cached route in each socket via pfctlinput */
2392    {
2393	struct sockaddr_in6 sdst;
2394
2395	bzero(&sdst, sizeof(sdst));
2396	sdst.sin6_family = AF_INET6;
2397	sdst.sin6_len = sizeof(struct sockaddr_in6);
2398	bcopy(&reddst6, &sdst.sin6_addr, sizeof(struct in6_addr));
2399	pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&sdst);
2400#ifdef IPSEC
2401	key_sa_routechange((struct sockaddr *)&sdst);
2402#endif
2403    }
2404
2405 freeit:
2406	m_freem(m);
2407	return;
2408
2409 bad:
2410	icmp6stat.icp6s_badredirect++;
2411	m_freem(m);
2412}
2413
2414void
2415icmp6_redirect_output(m0, rt)
2416	struct mbuf *m0;
2417	struct rtentry *rt;
2418{
2419	struct ifnet *ifp;	/* my outgoing interface */
2420	struct in6_addr *ifp_ll6;
2421	struct in6_addr *router_ll6;
2422	struct ip6_hdr *sip6;	/* m0 as struct ip6_hdr */
2423	struct mbuf *m = NULL;	/* newly allocated one */
2424	struct ip6_hdr *ip6;	/* m as struct ip6_hdr */
2425	struct nd_redirect *nd_rd;
2426	size_t maxlen;
2427	u_char *p;
2428	struct ifnet *outif = NULL;
2429	struct sockaddr_in6 src_sa;
2430
2431	icmp6_errcount(&icmp6stat.icp6s_outerrhist, ND_REDIRECT, 0);
2432
2433	/* if we are not router, we don't send icmp6 redirect */
2434	if (!ip6_forwarding || ip6_accept_rtadv)
2435		goto fail;
2436
2437	/* sanity check */
2438	if (!m0 || !rt || !(rt->rt_flags & RTF_UP) || !(ifp = rt->rt_ifp))
2439		goto fail;
2440
2441	/*
2442	 * Address check:
2443	 *  the source address must identify a neighbor, and
2444	 *  the destination address must not be a multicast address
2445	 *  [RFC 2461, sec 8.2]
2446	 */
2447	sip6 = mtod(m0, struct ip6_hdr *);
2448	bzero(&src_sa, sizeof(src_sa));
2449	src_sa.sin6_family = AF_INET6;
2450	src_sa.sin6_len = sizeof(src_sa);
2451	src_sa.sin6_addr = sip6->ip6_src;
2452	/* we don't currently use sin6_scope_id, but eventually use it */
2453	if (in6_addr2zoneid(ifp, &sip6->ip6_src, &src_sa.sin6_scope_id))
2454		goto fail;
2455	if (nd6_is_addr_neighbor(&src_sa, ifp) == 0)
2456		goto fail;
2457	if (IN6_IS_ADDR_MULTICAST(&sip6->ip6_dst))
2458		goto fail;	/* what should we do here? */
2459
2460	/* rate limit */
2461	if (icmp6_ratelimit(&sip6->ip6_src, ND_REDIRECT, 0))
2462		goto fail;
2463
2464	/*
2465	 * Since we are going to append up to 1280 bytes (= IPV6_MMTU),
2466	 * we almost always ask for an mbuf cluster for simplicity.
2467	 * (MHLEN < IPV6_MMTU is almost always true)
2468	 */
2469#if IPV6_MMTU >= MCLBYTES
2470# error assumption failed about IPV6_MMTU and MCLBYTES
2471#endif
2472	MGETHDR(m, M_DONTWAIT, MT_HEADER);
2473	if (m && IPV6_MMTU >= MHLEN)
2474		MCLGET(m, M_DONTWAIT);
2475	if (!m)
2476		goto fail;
2477	m->m_pkthdr.rcvif = NULL;
2478	m->m_len = 0;
2479	maxlen = M_TRAILINGSPACE(m);
2480	maxlen = min(IPV6_MMTU, maxlen);
2481	/* just for safety */
2482	if (maxlen < sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr) +
2483	    ((sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7)) {
2484		goto fail;
2485	}
2486
2487	{
2488		/* get ip6 linklocal address for ifp(my outgoing interface). */
2489		struct in6_ifaddr *ia;
2490		if ((ia = in6ifa_ifpforlinklocal(ifp,
2491						 IN6_IFF_NOTREADY|
2492						 IN6_IFF_ANYCAST)) == NULL)
2493			goto fail;
2494		ifp_ll6 = &ia->ia_addr.sin6_addr;
2495	}
2496
2497	/* get ip6 linklocal address for the router. */
2498	if (rt->rt_gateway && (rt->rt_flags & RTF_GATEWAY)) {
2499		struct sockaddr_in6 *sin6;
2500		sin6 = (struct sockaddr_in6 *)rt->rt_gateway;
2501		router_ll6 = &sin6->sin6_addr;
2502		if (!IN6_IS_ADDR_LINKLOCAL(router_ll6))
2503			router_ll6 = (struct in6_addr *)NULL;
2504	} else
2505		router_ll6 = (struct in6_addr *)NULL;
2506
2507	/* ip6 */
2508	ip6 = mtod(m, struct ip6_hdr *);
2509	ip6->ip6_flow = 0;
2510	ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
2511	ip6->ip6_vfc |= IPV6_VERSION;
2512	/* ip6->ip6_plen will be set later */
2513	ip6->ip6_nxt = IPPROTO_ICMPV6;
2514	ip6->ip6_hlim = 255;
2515	/* ip6->ip6_src must be linklocal addr for my outgoing if. */
2516	bcopy(ifp_ll6, &ip6->ip6_src, sizeof(struct in6_addr));
2517	bcopy(&sip6->ip6_src, &ip6->ip6_dst, sizeof(struct in6_addr));
2518
2519	/* ND Redirect */
2520	nd_rd = (struct nd_redirect *)(ip6 + 1);
2521	nd_rd->nd_rd_type = ND_REDIRECT;
2522	nd_rd->nd_rd_code = 0;
2523	nd_rd->nd_rd_reserved = 0;
2524	if (rt->rt_flags & RTF_GATEWAY) {
2525		/*
2526		 * nd_rd->nd_rd_target must be a link-local address in
2527		 * better router cases.
2528		 */
2529		if (!router_ll6)
2530			goto fail;
2531		bcopy(router_ll6, &nd_rd->nd_rd_target,
2532		    sizeof(nd_rd->nd_rd_target));
2533		bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_dst,
2534		    sizeof(nd_rd->nd_rd_dst));
2535	} else {
2536		/* make sure redtgt == reddst */
2537		bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_target,
2538		    sizeof(nd_rd->nd_rd_target));
2539		bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_dst,
2540		    sizeof(nd_rd->nd_rd_dst));
2541	}
2542
2543	p = (u_char *)(nd_rd + 1);
2544
2545	if (!router_ll6)
2546		goto nolladdropt;
2547
2548	{
2549		/* target lladdr option */
2550		struct rtentry *rt_router = NULL;
2551		int len;
2552		struct sockaddr_dl *sdl;
2553		struct nd_opt_hdr *nd_opt;
2554		char *lladdr;
2555
2556		rt_router = nd6_lookup(router_ll6, 0, ifp);
2557		if (!rt_router)
2558			goto nolladdropt;
2559		len = sizeof(*nd_opt) + ifp->if_addrlen;
2560		len = (len + 7) & ~7;	/* round by 8 */
2561		/* safety check */
2562		if (len + (p - (u_char *)ip6) > maxlen)
2563			goto nolladdropt;
2564		if (!(rt_router->rt_flags & RTF_GATEWAY) &&
2565		    (rt_router->rt_flags & RTF_LLINFO) &&
2566		    (rt_router->rt_gateway->sa_family == AF_LINK) &&
2567		    (sdl = (struct sockaddr_dl *)rt_router->rt_gateway) &&
2568		    sdl->sdl_alen) {
2569			nd_opt = (struct nd_opt_hdr *)p;
2570			nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
2571			nd_opt->nd_opt_len = len >> 3;
2572			lladdr = (char *)(nd_opt + 1);
2573			bcopy(LLADDR(sdl), lladdr, ifp->if_addrlen);
2574			p += len;
2575		}
2576	}
2577nolladdropt:;
2578
2579	m->m_pkthdr.len = m->m_len = p - (u_char *)ip6;
2580
2581	/* just to be safe */
2582#ifdef M_DECRYPTED	/*not openbsd*/
2583	if (m0->m_flags & M_DECRYPTED)
2584		goto noredhdropt;
2585#endif
2586	if (p - (u_char *)ip6 > maxlen)
2587		goto noredhdropt;
2588
2589	{
2590		/* redirected header option */
2591		int len;
2592		struct nd_opt_rd_hdr *nd_opt_rh;
2593
2594		/*
2595		 * compute the maximum size for icmp6 redirect header option.
2596		 * XXX room for auth header?
2597		 */
2598		len = maxlen - (p - (u_char *)ip6);
2599		len &= ~7;
2600
2601		/* This is just for simplicity. */
2602		if (m0->m_pkthdr.len != m0->m_len) {
2603			if (m0->m_next) {
2604				m_freem(m0->m_next);
2605				m0->m_next = NULL;
2606			}
2607			m0->m_pkthdr.len = m0->m_len;
2608		}
2609
2610		/*
2611		 * Redirected header option spec (RFC2461 4.6.3) talks nothing
2612		 * about padding/truncate rule for the original IP packet.
2613		 * From the discussion on IPv6imp in Feb 1999,
2614		 * the consensus was:
2615		 * - "attach as much as possible" is the goal
2616		 * - pad if not aligned (original size can be guessed by
2617		 *   original ip6 header)
2618		 * Following code adds the padding if it is simple enough,
2619		 * and truncates if not.
2620		 */
2621		if (m0->m_next || m0->m_pkthdr.len != m0->m_len)
2622			panic("assumption failed in %s:%d", __FILE__,
2623			    __LINE__);
2624
2625		if (len - sizeof(*nd_opt_rh) < m0->m_pkthdr.len) {
2626			/* not enough room, truncate */
2627			m0->m_pkthdr.len = m0->m_len = len -
2628			    sizeof(*nd_opt_rh);
2629		} else {
2630			/* enough room, pad or truncate */
2631			size_t extra;
2632
2633			extra = m0->m_pkthdr.len % 8;
2634			if (extra) {
2635				/* pad if easy enough, truncate if not */
2636				if (8 - extra <= M_TRAILINGSPACE(m0)) {
2637					/* pad */
2638					m0->m_len += (8 - extra);
2639					m0->m_pkthdr.len += (8 - extra);
2640				} else {
2641					/* truncate */
2642					m0->m_pkthdr.len -= extra;
2643					m0->m_len -= extra;
2644				}
2645			}
2646			len = m0->m_pkthdr.len + sizeof(*nd_opt_rh);
2647			m0->m_pkthdr.len = m0->m_len = len -
2648			    sizeof(*nd_opt_rh);
2649		}
2650
2651		nd_opt_rh = (struct nd_opt_rd_hdr *)p;
2652		bzero(nd_opt_rh, sizeof(*nd_opt_rh));
2653		nd_opt_rh->nd_opt_rh_type = ND_OPT_REDIRECTED_HEADER;
2654		nd_opt_rh->nd_opt_rh_len = len >> 3;
2655		p += sizeof(*nd_opt_rh);
2656		m->m_pkthdr.len = m->m_len = p - (u_char *)ip6;
2657
2658		/* connect m0 to m */
2659		m_tag_delete_chain(m0, NULL);
2660		m0->m_flags &= ~M_PKTHDR;
2661		m->m_next = m0;
2662		m->m_pkthdr.len = m->m_len + m0->m_len;
2663		m0 = NULL;
2664	}
2665noredhdropt:;
2666	if (m0) {
2667		m_freem(m0);
2668		m0 = NULL;
2669	}
2670
2671	/* XXX: clear embedded link IDs in the inner header */
2672	in6_clearscope(&sip6->ip6_src);
2673	in6_clearscope(&sip6->ip6_dst);
2674	in6_clearscope(&nd_rd->nd_rd_target);
2675	in6_clearscope(&nd_rd->nd_rd_dst);
2676
2677	ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
2678
2679	nd_rd->nd_rd_cksum = 0;
2680	nd_rd->nd_rd_cksum = in6_cksum(m, IPPROTO_ICMPV6,
2681	    sizeof(*ip6), ntohs(ip6->ip6_plen));
2682
2683	/* send the packet to outside... */
2684	ip6_output(m, NULL, NULL, 0, NULL, &outif, NULL);
2685	if (outif) {
2686		icmp6_ifstat_inc(outif, ifs6_out_msg);
2687		icmp6_ifstat_inc(outif, ifs6_out_redirect);
2688	}
2689	icmp6stat.icp6s_outhist[ND_REDIRECT]++;
2690
2691	return;
2692
2693fail:
2694	if (m)
2695		m_freem(m);
2696	if (m0)
2697		m_freem(m0);
2698}
2699
2700#ifdef HAVE_NRL_INPCB
2701#define sotoin6pcb	sotoinpcb
2702#define in6pcb		inpcb
2703#define in6p_icmp6filt	inp_icmp6filt
2704#endif
2705/*
2706 * ICMPv6 socket option processing.
2707 */
2708int
2709icmp6_ctloutput(so, sopt)
2710	struct socket *so;
2711	struct sockopt *sopt;
2712{
2713	int error = 0;
2714	int optlen;
2715	struct inpcb *inp = sotoinpcb(so);
2716	int level, op, optname;
2717
2718	if (sopt) {
2719		level = sopt->sopt_level;
2720		op = sopt->sopt_dir;
2721		optname = sopt->sopt_name;
2722		optlen = sopt->sopt_valsize;
2723	} else
2724		level = op = optname = optlen = 0;
2725
2726	if (level != IPPROTO_ICMPV6) {
2727		return EINVAL;
2728	}
2729
2730	switch (op) {
2731	case PRCO_SETOPT:
2732		switch (optname) {
2733		case ICMP6_FILTER:
2734		    {
2735			struct icmp6_filter *p;
2736
2737			if (optlen != sizeof(*p)) {
2738				error = EMSGSIZE;
2739				break;
2740			}
2741			if (inp->in6p_icmp6filt == NULL) {
2742				error = EINVAL;
2743				break;
2744			}
2745			error = sooptcopyin(sopt, inp->in6p_icmp6filt, optlen,
2746				optlen);
2747			break;
2748		    }
2749
2750		default:
2751			error = ENOPROTOOPT;
2752			break;
2753		}
2754		break;
2755
2756	case PRCO_GETOPT:
2757		switch (optname) {
2758		case ICMP6_FILTER:
2759		    {
2760			if (inp->in6p_icmp6filt == NULL) {
2761				error = EINVAL;
2762				break;
2763			}
2764			error = sooptcopyout(sopt, inp->in6p_icmp6filt,
2765				sizeof(struct icmp6_filter));
2766			break;
2767		    }
2768
2769		default:
2770			error = ENOPROTOOPT;
2771			break;
2772		}
2773		break;
2774	}
2775
2776	return (error);
2777}
2778#ifdef HAVE_NRL_INPCB
2779#undef sotoin6pcb
2780#undef in6pcb
2781#undef in6p_icmp6filt
2782#endif
2783
2784#ifndef HAVE_PPSRATECHECK
2785#ifndef timersub
2786#define	timersub(tvp, uvp, vvp)						\
2787	do {								\
2788		(vvp)->tv_sec = (tvp)->tv_sec - (uvp)->tv_sec;		\
2789		(vvp)->tv_usec = (tvp)->tv_usec - (uvp)->tv_usec;	\
2790		if ((vvp)->tv_usec < 0) {				\
2791			(vvp)->tv_sec--;				\
2792			(vvp)->tv_usec += 1000000;			\
2793		}							\
2794	} while (0)
2795#endif
2796
2797/*
2798 * ppsratecheck(): packets (or events) per second limitation.
2799 */
2800static int
2801ppsratecheck(lasttime, curpps, maxpps)
2802	struct timeval *lasttime;
2803	int *curpps;
2804	int maxpps;	/* maximum pps allowed */
2805{
2806	struct timeval tv, delta;
2807	int s, rv;
2808
2809	s = splclock();
2810	microtime(&tv);
2811	splx(s);
2812
2813	timersub(&tv, lasttime, &delta);
2814
2815	/*
2816	 * Check for 0,0 so that the message will be seen at least once.
2817	 * If more than one second has passed since the last update of
2818	 * lasttime, reset the counter.
2819	 *
2820	 * We do increment *curpps even in *curpps < maxpps case, as some may
2821	 * try to use *curpps for stat purposes as well.
2822	 */
2823	if ((lasttime->tv_sec == 0 && lasttime->tv_usec == 0) ||
2824	    delta.tv_sec >= 1) {
2825		*lasttime = tv;
2826		*curpps = 0;
2827		rv = 1;
2828	} else if (maxpps < 0)
2829		rv = 1;
2830	else if (*curpps < maxpps)
2831		rv = 1;
2832	else
2833		rv = 0;
2834
2835#if 1 /* DIAGNOSTIC? */
2836	/* be careful about wrap-around */
2837	if (*curpps + 1 > *curpps)
2838		*curpps = *curpps + 1;
2839#else
2840	/*
2841	 * assume that there's not too many calls to this function.
2842	 * not sure if the assumption holds, as it depends on *caller's*
2843	 * behavior, not the behavior of this function.
2844	 * IMHO it is wrong to make assumption on the caller's behavior,
2845	 * so the above #if is #if 1, not #ifdef DIAGNOSTIC.
2846	 */
2847	*curpps = *curpps + 1;
2848#endif
2849
2850	return (rv);
2851}
2852#endif
2853
2854/*
2855 * Perform rate limit check.
2856 * Returns 0 if it is okay to send the icmp6 packet.
2857 * Returns 1 if the router SHOULD NOT send this icmp6 packet due to rate
2858 * limitation.
2859 *
2860 * XXX per-destination/type check necessary?
2861 */
2862static int
2863icmp6_ratelimit(dst, type, code)
2864	const struct in6_addr *dst;	/* not used at this moment */
2865	const int type;			/* not used at this moment */
2866	const int code;			/* not used at this moment */
2867{
2868	int ret;
2869
2870	ret = 0;	/* okay to send */
2871
2872	/* PPS limit */
2873	if (!ppsratecheck(&icmp6errppslim_last, &icmp6errpps_count,
2874	    icmp6errppslim)) {
2875		/* The packet is subject to rate limit */
2876		ret++;
2877	}
2878
2879	return ret;
2880}
2881